Issue is that API/Request.php sanitizes the $description parameter before it is stored in the DB (via UrlHelper::getArrayFromQueryString()), and twig will escape again. A quick fix would be to not escape in the template, but this would make the current strategy more entrenched. Still thinking about what the best fix is.

I have a solution that will be a start for #4231.

Added to the (long) list in #6714. By the way @diosmosis do you think #6714 duplicates #4231? (e.g. same goals -> move to sanitizing on output) I could move information in the older issue if that's the case.

Seems like there's a lot of overlap; The newer one has more information, a more definitive answer to the approach to take and you're obviously maintaining the list of stuff to do, so we could keep that one. We just need one in the 3.0 milestone I think.

Yours has more history, I've merged #6714 into #4231 with the information.

Noted during testing this is still present in 3.0.0-rc3