Admin related security issue

This is an admin only issue, so these are allowed to go through the public queues.

      $empty_text = t($instance['field_empty_text']);

      // Add a render array to output for the field formatter to display.
      $output[$field_id] = array(
        '#weight' => $instance_display['weight'],
        '#label_display' => $instance_display['label'],
        '#title' => $instance['label'],
        '#bundle' => $bundle,
        '#entity_type' =>  $entity_type,
        '#field_name' => $field_id,
        '#field_type' => 'text',
        '#items' => array(),
        '#formatter' => 'text_default',
        '#theme' => 'field',
        '#items' => array(
          0 => array(
            'value' => $empty_text,
          ),
        ),
        0 => array('#markup' => $empty_text),
      );

Two issues here:

$empty_text = t($instance['field_empty_text']);

This is wrong as far as the i18n guys are concerned, you should never run user text through t().

The security concern, which is only exposed if the user can configure fields. (thus the issue rather than kicking this off the main security channels)

0 => array('#markup' => $empty_text),

There is no checks on this text. I use the most permissive function filter_xss_admin(), although maybe fields should have the slightly more protective callback field_filter_xss() that is applied to field labels.