I'm trying to get my head around the full process drupal uses regarding making nodes safe for display and whether there are any changes in 4.7 regarding this. I did a quick search and could not find this decision tree written out, so I thought I'd take a quick stab. Can anyone double-check that this sounds correct:
The process begins with node.module’s node_view making the following decision: If the node type’s module has a hook_view, let the module handle any filtering. Otherwise node.module will pass the body or teaser through node_prepare.
If we are using a hook_view, the module should first call node_prepare on the body / teaser. Then the module will pass it on to the theme. An example from forum.module’s forum_view:
$node = node_prepare($node, $teaser);
$node->body .= theme('forum_topic_navigation', $node);
This would suggest that the theme should not have to worry about making user-supplied content safe, but it appears that the general practice for custom content fields is to filter them in the theme function. On reason for this might be the l() function, which seems to filter the title of the link. If we were to filter all content at the hook_view level, things might get double-encoded[1]. However, in theory this opens the door for site admins and theme developers to overlook these calls to check_plain or l() while overwriting the theme function in their theme.