html escaping only works on things coming from fdroiddata, not on upstream provided descriptions
Shouldn't that be the other way around?
I think fdroidserver already escapes html tags for in metadata descriptions. So using loofah here doesn't seem to actually do anything?
And for descriptions coming from localized blocks they are copied by fdroidserver as is and then not escaped during the website build.