Replace usage of .html(...) with .text(...) where possible;
Wrap input with fs.sanitize(...) where .html() must be used.

Change-Id: I39e20b6fb561b3a1801579ca6a86a5f94483e4a9
diff --git a/web/gui/src/main/webapp/app/fw/widget/tooltip.js b/web/gui/src/main/webapp/app/fw/widget/tooltip.js
index b982347..beca6f8 100644
--- a/web/gui/src/main/webapp/app/fw/widget/tooltip.js
+++ b/web/gui/src/main/webapp/app/fw/widget/tooltip.js
@@ -36,7 +36,7 @@
 
     function init() {
         tooltip = d3.select('#tooltip');
-        tooltip.html('');
+        tooltip.text('');
     }
 
     function tipStyle(mouseX, mouseY) {