Update to Drupal 8.0.0-beta15. For more information, see: https://www.drupal.org/node/2563023

core/lib/Drupal/Core/StringTranslation/StringTranslationTrait.php

@@ -37,6 +37,10 @@ trait StringTranslationTrait {
    * Translates a string to the current language or to a given language.
    *
    * See the t() documentation for details.
+   *
+   * Never call $this->t($user_text) where $user_text is text that a user
+   * entered; doing so can lead to cross-site scripting and other security
+   * problems.
    */
   protected function t($string, array $args = array(), array $options = array()) {
     return $this->getStringTranslation()->translate($string, $args, $options);

core/lib/Drupal/Core/StringTranslation/TranslationInterface.php

@@ -17,6 +17,10 @@ interface TranslationInterface {
   /**
    * Translates a string to the current language or to a given language.
    *
+   * Never call translate($user_text) where $user_text is text that a user
+   * entered; doing so can lead to cross-site scripting and other security
+   * problems.
+   *
    * @param string $string
    *   A string containing the English string to translate.
    * @param array $args

core/lib/Drupal/Core/StringTranslation/TranslationManager.php

@@ -142,7 +142,15 @@ class TranslationManager implements TranslationInterface, TranslatorInterface {
   public function translate($string, array $args = array(), array $options = array()) {
     $string = $this->doTranslate($string, $options);
     if (empty($args)) {
-      return SafeMarkup::set($string);
+      // We add the string to the safe list as opposed to making it an object
+      // implementing SafeStringInterface as we may need to call __toString()
+      // on the object before render time, at which point the string ceases to
+      // be safe, and working around this would require significant rework.
+      // Adding this string to the safe list is assumed to be safe because
+      // translate() should only be called with strings defined in code.
+      // @see \Drupal\Core\StringTranslation\TranslationInterface::translate()
+      SafeMarkup::setMultiple([$string => ['html' => TRUE]]);
+      return $string;
     }
     else {
       return SafeMarkup::format($string, $args);

core/lib/Drupal/Core/StringTranslation/TranslationWrapper.php

@@ -118,4 +118,14 @@ class TranslationWrapper implements SafeStringInterface {
     return array('string', 'arguments', 'options');
   }
 
+  /**
+   * Returns a representation of the object for use in JSON serialization.
+   *
+   * @return string
+   *   The safe string content.
+   */
+  public function jsonSerialize() {
+    return $this->__toString();
+  }
+
 }