diff --git a/user/src/com/google/gwt/dom/client/DOMImplTrident.java b/user/src/com/google/gwt/dom/client/DOMImplTrident.java
index 0ed64ba..a467d1d 100644
--- a/user/src/com/google/gwt/dom/client/DOMImplTrident.java
+++ b/user/src/com/google/gwt/dom/client/DOMImplTrident.java
@@ -15,6 +15,8 @@
  */
 package com.google.gwt.dom.client;
 
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
+
 abstract class DOMImplTrident extends DOMImpl {
 
   /**
@@ -60,6 +62,7 @@
   }-*/;
 
   @Override
+  @SuppressIsSafeHtmlCastCheck
   public Element createElement(Document doc, String tagName) {
     if (tagName.contains(":")) {
       // Special implementation for tag names with namespace-prefixes. The only
diff --git a/user/src/com/google/gwt/dom/client/Element.java b/user/src/com/google/gwt/dom/client/Element.java
index 5f75f5d..55a3899 100644
--- a/user/src/com/google/gwt/dom/client/Element.java
+++ b/user/src/com/google/gwt/dom/client/Element.java
@@ -17,6 +17,7 @@
 
 import com.google.gwt.core.client.JavaScriptObject;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * All HTML element interfaces derive from this class.
@@ -698,7 +699,7 @@
   /**
    * All of the markup and content within a given element.
    */
-  public final native void setInnerHTML(String html) /*-{
+  public final native void setInnerHTML(@IsSafeHtml String html) /*-{
      this.innerHTML = html || '';
    }-*/;
 
diff --git a/user/src/com/google/gwt/i18n/shared/BidiFormatter.java b/user/src/com/google/gwt/i18n/shared/BidiFormatter.java
index b6b728c..3759462 100644
--- a/user/src/com/google/gwt/i18n/shared/BidiFormatter.java
+++ b/user/src/com/google/gwt/i18n/shared/BidiFormatter.java
@@ -18,6 +18,8 @@
 
 import com.google.gwt.i18n.client.HasDirection.Direction;
 import com.google.gwt.i18n.client.LocaleInfo;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 /**
  * Utility class for formatting text for display in a potentially
@@ -262,6 +264,8 @@
    * @param str The input string
    * @return Input string after applying the above processing.
    */
+  @SuppressIsSafeHtmlCastCheck
+  @IsSafeHtml
   public String spanWrap(String str) {
     return spanWrap(str, false, true);
   }
@@ -274,7 +278,8 @@
    * @param isHtml Whether {@code str} is HTML / HTML-escaped
    * @return Input string after applying the above processing.
    */
-  public String spanWrap(String str, boolean isHtml) {
+  @IsSafeHtml
+  public String spanWrap(@IsSafeHtml String str, boolean isHtml) {
     return spanWrap(str, isHtml, true);
   }
 
@@ -303,7 +308,8 @@
    *          of whatever may follow {@code str}
    * @return Input string after applying the above processing.
    */
-  public String spanWrap(String str, boolean isHtml, boolean dirReset) {
+  @IsSafeHtml
+  public String spanWrap(@IsSafeHtml String str, boolean isHtml, boolean dirReset) {
     return spanWrapBase(str, isHtml, dirReset);
   }
 
@@ -316,6 +322,8 @@
    * @param str The input string
    * @return Input string after applying the above processing.
    */
+  @SuppressIsSafeHtmlCastCheck
+  @IsSafeHtml
   public String spanWrapWithKnownDir(Direction dir, String str) {
     return spanWrapWithKnownDir(dir, str, false, true);
   }
@@ -330,7 +338,8 @@
    * @param isHtml Whether {@code str} is HTML / HTML-escaped
    * @return Input string after applying the above processing.
    */
-  public String spanWrapWithKnownDir(Direction dir, String str, boolean isHtml) {
+  @IsSafeHtml
+  public String spanWrapWithKnownDir(Direction dir, @IsSafeHtml String str, boolean isHtml) {
     return spanWrapWithKnownDir(dir, str, isHtml, true);
   }
 
@@ -360,8 +369,9 @@
    *          of whatever may follow {@code str}
    * @return Input string after applying the above processing.
    */
-  public String spanWrapWithKnownDir(Direction dir, String str, boolean isHtml,
-      boolean dirReset) {
+  @IsSafeHtml
+  public String spanWrapWithKnownDir(
+      Direction dir, @IsSafeHtml String str, boolean isHtml, boolean dirReset) {
     return spanWrapWithKnownDirBase(dir, str, isHtml, dirReset);
   }
 
diff --git a/user/src/com/google/gwt/i18n/shared/BidiFormatterBase.java b/user/src/com/google/gwt/i18n/shared/BidiFormatterBase.java
index d604a2e..b12162b 100644
--- a/user/src/com/google/gwt/i18n/shared/BidiFormatterBase.java
+++ b/user/src/com/google/gwt/i18n/shared/BidiFormatterBase.java
@@ -18,6 +18,8 @@
 
 import com.google.gwt.i18n.client.HasDirection.Direction;
 import com.google.gwt.safehtml.shared.SafeHtmlUtils;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 /**
  * Base class for {@link BidiFormatter} and {@link SafeHtmlBidiFormatter} that
@@ -240,7 +242,8 @@
    *          of whatever may follow {@code str}
    * @return Input string after applying the above processing.
    */
-  protected String spanWrapBase(String str, boolean isHtml, boolean dirReset) {
+  @IsSafeHtml
+  protected String spanWrapBase(@IsSafeHtml String str, boolean isHtml, boolean dirReset) {
     Direction dir = BidiUtils.get().estimateDirection(str, isHtml);
     return spanWrapWithKnownDirBase(dir, str, isHtml, dirReset);
   }
@@ -256,8 +259,10 @@
    *          of whatever may follow {@code str}
    * @return Input string after applying the above processing.
    */
-  protected String spanWrapWithKnownDirBase(Direction dir, String str,
-      boolean isHtml, boolean dirReset) {
+  @SuppressIsSafeHtmlCastCheck
+  @IsSafeHtml
+  protected String spanWrapWithKnownDirBase(
+      Direction dir, @IsSafeHtml String str, boolean isHtml, boolean dirReset) {
     boolean dirCondition = dir != Direction.DEFAULT && dir != contextDir;
     String origStr = str;
     if (!isHtml) {
diff --git a/user/src/com/google/gwt/i18n/shared/SafeHtmlBidiFormatter.java b/user/src/com/google/gwt/i18n/shared/SafeHtmlBidiFormatter.java
index 592a144..8f1db80 100644
--- a/user/src/com/google/gwt/i18n/shared/SafeHtmlBidiFormatter.java
+++ b/user/src/com/google/gwt/i18n/shared/SafeHtmlBidiFormatter.java
@@ -20,6 +20,7 @@
 import com.google.gwt.i18n.client.LocaleInfo;
 import com.google.gwt.safehtml.shared.SafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtmlUtils;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 import java.util.HashMap;
 
@@ -266,6 +267,7 @@
    *          of whatever may follow {@code str}
    * @return Input string after applying the above processing.
    */
+  @SuppressIsSafeHtmlCastCheck
   public SafeHtml spanWrap(String str, boolean dirReset) {
     // This is safe since spanWrapBase escapes plain-text input.
     return SafeHtmlUtils.fromTrustedString(spanWrapBase(str, false, dirReset));
@@ -323,8 +325,8 @@
    *          of whatever may follow {@code str}
    * @return Input string after applying the above processing.
    */
-  public SafeHtml spanWrapWithKnownDir(Direction dir, String str,
-      boolean dirReset) {
+  @SuppressIsSafeHtmlCastCheck
+  public SafeHtml spanWrapWithKnownDir(Direction dir, String str, boolean dirReset) {
     // This is safe since spanWrapWithKnownDirBase escapes plain-text input.
     return SafeHtmlUtils.fromTrustedString(
         spanWrapWithKnownDirBase(dir, str, false, dirReset));
diff --git a/user/src/com/google/gwt/logging/client/HasWidgetsLogHandler.java b/user/src/com/google/gwt/logging/client/HasWidgetsLogHandler.java
index f2fec42..5a945c6 100644
--- a/user/src/com/google/gwt/logging/client/HasWidgetsLogHandler.java
+++ b/user/src/com/google/gwt/logging/client/HasWidgetsLogHandler.java
@@ -16,6 +16,7 @@
 
 package com.google.gwt.logging.client;
 
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 import com.google.gwt.user.client.ui.HTML;
 import com.google.gwt.user.client.ui.HasWidgets;
 import com.google.gwt.user.client.ui.Label;
@@ -56,6 +57,7 @@
   }
 
   @Override
+  @SuppressIsSafeHtmlCastCheck
   public void publish(LogRecord record) {
     if (!isLoggable(record)) {
       return;
diff --git a/user/src/com/google/gwt/safehtml/shared/OnlyToBeUsedInGeneratedCodeStringBlessedAsSafeHtml.java b/user/src/com/google/gwt/safehtml/shared/OnlyToBeUsedInGeneratedCodeStringBlessedAsSafeHtml.java
index a32ad27..c21f78d 100644
--- a/user/src/com/google/gwt/safehtml/shared/OnlyToBeUsedInGeneratedCodeStringBlessedAsSafeHtml.java
+++ b/user/src/com/google/gwt/safehtml/shared/OnlyToBeUsedInGeneratedCodeStringBlessedAsSafeHtml.java
@@ -15,6 +15,9 @@
  */
 package com.google.gwt.safehtml.shared;
 
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
+
 /**
  * A string wrapped as an object of type {@link SafeHtml}.
  *
@@ -42,6 +45,8 @@
   /**
    * {@inheritDoc}
    */
+  @IsSafeHtml
+  @SuppressIsSafeHtmlCastCheck
   public String asString() {
     return html;
   }
diff --git a/user/src/com/google/gwt/safehtml/shared/SafeHtml.java b/user/src/com/google/gwt/safehtml/shared/SafeHtml.java
index 9983120..441fa13 100644
--- a/user/src/com/google/gwt/safehtml/shared/SafeHtml.java
+++ b/user/src/com/google/gwt/safehtml/shared/SafeHtml.java
@@ -15,6 +15,8 @@
  */
 package com.google.gwt.safehtml.shared;
 
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+
 import java.io.Serializable;
 
 /**
@@ -87,6 +89,7 @@
    * 
    * @return the contents as a String
    */
+  @IsSafeHtml
   String asString();
 
   /**
diff --git a/user/src/com/google/gwt/safehtml/shared/SafeHtmlString.java b/user/src/com/google/gwt/safehtml/shared/SafeHtmlString.java
index f514f8b..c960f39 100644
--- a/user/src/com/google/gwt/safehtml/shared/SafeHtmlString.java
+++ b/user/src/com/google/gwt/safehtml/shared/SafeHtmlString.java
@@ -15,6 +15,9 @@
  */
 package com.google.gwt.safehtml.shared;
 
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
+
 /**
  * A string wrapped as an object of type {@link SafeHtml}.
  *
@@ -54,6 +57,8 @@
   /**
    * {@inheritDoc}
    */
+  @IsSafeHtml
+  @SuppressIsSafeHtmlCastCheck
   public String asString() {
     return html;
   }
diff --git a/user/src/com/google/gwt/safehtml/shared/annotations/IsSafeHtml.java b/user/src/com/google/gwt/safehtml/shared/annotations/IsSafeHtml.java
new file mode 100644
index 0000000..de55a7e
--- /dev/null
+++ b/user/src/com/google/gwt/safehtml/shared/annotations/IsSafeHtml.java
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2015 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package com.google.gwt.safehtml.shared.annotations;
+
+import static java.lang.annotation.ElementType.FIELD;
+import static java.lang.annotation.ElementType.LOCAL_VARIABLE;
+import static java.lang.annotation.ElementType.METHOD;
+import static java.lang.annotation.ElementType.PARAMETER;
+
+import java.lang.annotation.Target;
+
+/**
+ * A type annotation that represents values that are safe to use in a HTML context.
+ * <p>
+ * The annotated type {@code @IsSafeHtml String} and the type {@code SafeHtml} are semantically
+ * equivalent.
+ */
+@Target({PARAMETER, METHOD, FIELD, LOCAL_VARIABLE})
+public @interface IsSafeHtml {
+}
\ No newline at end of file
diff --git a/user/src/com/google/gwt/safehtml/shared/annotations/SuppressIsSafeHtmlCastCheck.java b/user/src/com/google/gwt/safehtml/shared/annotations/SuppressIsSafeHtmlCastCheck.java
new file mode 100644
index 0000000..a2b2dcf
--- /dev/null
+++ b/user/src/com/google/gwt/safehtml/shared/annotations/SuppressIsSafeHtmlCastCheck.java
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2015 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not
+ * use this file except in compliance with the License. You may obtain a copy of
+ * the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+
+package com.google.gwt.safehtml.shared.annotations;
+
+/**
+ * Annotates methods that rely on potentially-unsafe type-annotation casts.
+ * <p>
+ * This annotation marks methods in which an expression without a
+ * {@link com.google.gwt.safehtml.shared.annotations.IsSafeHtml} annotation is used in a context
+ *  where such an annotation is required (e.g., the return statement of a method that
+ * returns {@code @IsSafeHtml String}).
+ * <p>
+ * As such, use of this annotation marks code that is potentially prone to HTML-injection
+ * vulnerabilities, and which hence needs to be carefully security reviewed.
+ */
+public @interface SuppressIsSafeHtmlCastCheck {
+}
diff --git a/user/src/com/google/gwt/uibinder/client/UiBinderUtil.java b/user/src/com/google/gwt/uibinder/client/UiBinderUtil.java
index 7e96db3..622ce30 100644
--- a/user/src/com/google/gwt/uibinder/client/UiBinderUtil.java
+++ b/user/src/com/google/gwt/uibinder/client/UiBinderUtil.java
@@ -18,6 +18,7 @@
 import com.google.gwt.dom.client.Document;
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.dom.client.Node;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.ui.RootPanel;
 import com.google.gwt.user.client.ui.UIObject;
 
@@ -81,7 +82,7 @@
     return new TempAttachment(origParent, origSibling, element);
   }
 
-  public static Element fromHtml(String html) {
+  public static Element fromHtml(@IsSafeHtml String html) {
     ensureHiddenDiv();
     hiddenDiv.setInnerHTML(html);
     Element newbie = hiddenDiv.getFirstChildElement();
diff --git a/user/src/com/google/gwt/user/cellview/client/CellTreeNodeView.java b/user/src/com/google/gwt/user/cellview/client/CellTreeNodeView.java
index 8a316a9..6e53fc6 100644
--- a/user/src/com/google/gwt/user/cellview/client/CellTreeNodeView.java
+++ b/user/src/com/google/gwt/user/cellview/client/CellTreeNodeView.java
@@ -1186,7 +1186,7 @@
       ensureAnimationFrame().appendChild(contentContainer);
 
       emptyMessageElem = Document.get().createDivElement();
-      emptyMessageElem.setInnerHTML(messages.emptyTree());
+      emptyMessageElem.setInnerText(messages.emptyTree());
       setStyleName(emptyMessageElem, tree.getStyle().cellTreeEmptyMessage(), true);
       showOrHide(emptyMessageElem, false);
       contentContainer.appendChild(emptyMessageElem);
diff --git a/user/src/com/google/gwt/user/client/DOM.java b/user/src/com/google/gwt/user/client/DOM.java
index fdbe95c..cf19b12 100644
--- a/user/src/com/google/gwt/user/client/DOM.java
+++ b/user/src/com/google/gwt/user/client/DOM.java
@@ -22,6 +22,7 @@
 import com.google.gwt.dom.client.ImageElement;
 import com.google.gwt.dom.client.OptionElement;
 import com.google.gwt.dom.client.SelectElement;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.Event.NativePreviewEvent;
 import com.google.gwt.user.client.impl.DOMImpl;
 
@@ -1277,13 +1278,13 @@
 
   /**
    * Sets the HTML contained within an element.
-   * 
+   *
    * @param elem the element whose inner HTML is to be set
    * @param html the new html
    * @deprecated Use {@link Element#setInnerHTML(String)} instead.
    */
   @Deprecated
-  public static void setInnerHTML(Element elem, String html) {
+  public static void setInnerHTML(Element elem, @IsSafeHtml String html) {
     elem.setInnerHTML(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/Anchor.java b/user/src/com/google/gwt/user/client/ui/Anchor.java
index 1d39293..a5f73ae 100644
--- a/user/src/com/google/gwt/user/client/ui/Anchor.java
+++ b/user/src/com/google/gwt/user/client/ui/Anchor.java
@@ -25,6 +25,8 @@
 import com.google.gwt.i18n.shared.HasDirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
 import com.google.gwt.safehtml.shared.SafeUri;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 /**
  * A widget that represents a simple &lt;a&gt; element.
@@ -163,10 +165,10 @@
 
   /**
    * Creates an anchor for scripting.
-   * 
+   *
    * The anchor's href is set to <code>javascript:;</code>, based on the
    * expectation that listeners will be added to the anchor.
-   * 
+   *
    * @param text the anchor's text
    */
   public Anchor(String text) {
@@ -203,14 +205,14 @@
 
   /**
    * Creates an anchor for scripting.
-   * 
+   *
    * The anchor's href is set to <code>javascript:;</code>, based on the
    * expectation that listeners will be added to the anchor.
-   * 
+   *
    * @param text the anchor's text
    * @param asHtml <code>true</code> to treat the specified text as html
    */
-  public Anchor(String text, boolean asHtml) {
+  public Anchor(@IsSafeHtml String text, boolean asHtml) {
     this(text, asHtml, DEFAULT_HREF);
   }
 
@@ -286,36 +288,38 @@
 
   /**
    * Creates an anchor with its text and href (target URL) specified.
-   * 
+   *
    * @param text the anchor's text
    * @param href the url to which it will link
    */
+  @SuppressIsSafeHtmlCastCheck
   public Anchor(String text, String href) {
     this(text, false, href);
   }
 
   /**
    * Creates an anchor with its text and href (target URL) specified.
-   * 
+   *
    * @param text the anchor's text
    * @param dir the text's direction
    * @param href the url to which it will link
    */
+  @SuppressIsSafeHtmlCastCheck
   public Anchor(String text, Direction dir, String href) {
     this(text, false, dir, href);
   }
 
   /**
    * Creates an anchor with its text and href (target URL) specified.
-   * 
+   *
    * @param text the anchor's text
    * @param directionEstimator A DirectionEstimator object used for automatic
    *          direction adjustment. For convenience,
    *          {@link #DEFAULT_DIRECTION_ESTIMATOR} can be used.
    * @param href the url to which it will link
    */
-  public Anchor(String text, DirectionEstimator directionEstimator,
-      String href) {
+  @SuppressIsSafeHtmlCastCheck
+  public Anchor(String text, DirectionEstimator directionEstimator, String href) {
     this(text, false, directionEstimator, href);
   }
 
@@ -326,7 +330,7 @@
    * @param asHTML <code>true</code> to treat the specified text as html
    * @param href the url to which it will link
    */
-  public Anchor(String text, boolean asHTML, String href) {
+  public Anchor(@IsSafeHtml String text, boolean asHTML, String href) {
     this();
     directionalTextHelper.setTextOrHtml(text, asHTML);
     setHref(href);
@@ -362,12 +366,13 @@
 
   /**
    * Creates a source anchor with a frame target.
-   * 
+   *
    * @param text the anchor's text
    * @param href the url to which it will link
    * @param target the target frame (e.g. "_blank" to open the link in a new
    *          window)
    */
+  @SuppressIsSafeHtmlCastCheck
   public Anchor(String text, String href, String target) {
     this(text, false, href, target);
   }
@@ -383,7 +388,7 @@
    * @param target the target frame (e.g. "_blank" to open the link in a new
    *          window)
    */
-  public Anchor(String text, boolean asHtml, String href, String target) {
+  public Anchor(@IsSafeHtml String text, boolean asHtml, String href, String target) {
     this(text, asHtml, href);
     setTarget(target);
   }
@@ -403,13 +408,13 @@
 
   /**
    * Creates an anchor with its text, direction and href (target URL) specified.
-   * 
+   *
    * @param text the anchor's text
    * @param asHTML <code>true</code> to treat the specified text as html
    * @param dir the text's direction
    * @param href the url to which it will link
    */
-  private Anchor(String text, boolean asHTML, Direction dir, String href) {
+  private Anchor(@IsSafeHtml String text, boolean asHTML, Direction dir, String href) {
     this();
     directionalTextHelper.setTextOrHtml(text, dir, asHTML);
     setHref(href);
@@ -417,7 +422,7 @@
 
   /**
    * Creates an anchor with its text, direction and href (target URL) specified.
-   * 
+   *
    * @param text the anchor's text
    * @param asHTML <code>true</code> to treat the specified text as html
    * @param directionEstimator A DirectionEstimator object used for automatic
@@ -425,8 +430,8 @@
    *          {@link #DEFAULT_DIRECTION_ESTIMATOR} can be used.
    * @param href the url to which it will link
    */
-  private Anchor(String text, boolean asHTML,
-      DirectionEstimator directionEstimator, String href) {
+  private Anchor(
+      @IsSafeHtml String text, boolean asHTML, DirectionEstimator directionEstimator, String href) {
     this();
     directionalTextHelper.setDirectionEstimator(directionEstimator);
     directionalTextHelper.setTextOrHtml(text, asHTML);
@@ -575,7 +580,7 @@
   }
 
   @Override
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     directionalTextHelper.setHtml(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/Button.java b/user/src/com/google/gwt/user/client/ui/Button.java
index 649d821..b1e5aec 100644
--- a/user/src/com/google/gwt/user/client/ui/Button.java
+++ b/user/src/com/google/gwt/user/client/ui/Button.java
@@ -20,6 +20,7 @@
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.event.dom.client.ClickHandler;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * A standard push-button widget.
@@ -85,20 +86,20 @@
    *
    * @param html the HTML caption
    */
-  public Button(String html) {
+  public Button(@IsSafeHtml String html) {
     this();
     setHTML(html);
   }
 
   /**
    * Creates a button with the given HTML caption and click listener.
-   * 
+   *
    * @param html the HTML caption
    * @param listener the click listener
    * @deprecated Use {@link Button#Button(String, ClickHandler)} instead
    */
   @Deprecated
-  public Button(String html, ClickListener listener) {
+  public Button(@IsSafeHtml String html, ClickListener listener) {
     this(html);
     addClickListener(listener);
   }
@@ -119,7 +120,7 @@
    * @param html the HTML caption
    * @param handler the click handler
    */
-  public Button(String html, ClickHandler handler) {
+  public Button(@IsSafeHtml String html, ClickHandler handler) {
     this(html);
     addClickHandler(handler);
   }
diff --git a/user/src/com/google/gwt/user/client/ui/ButtonBase.java b/user/src/com/google/gwt/user/client/ui/ButtonBase.java
index 3714c48..c884b12 100644
--- a/user/src/com/google/gwt/user/client/ui/ButtonBase.java
+++ b/user/src/com/google/gwt/user/client/ui/ButtonBase.java
@@ -18,6 +18,7 @@
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.safehtml.client.HasSafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * Abstract base class for {@link com.google.gwt.user.client.ui.Button},
@@ -44,7 +45,7 @@
     return getElement().getInnerText();
   }
 
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     getElement().setInnerHTML(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/CaptionPanel.java b/user/src/com/google/gwt/user/client/ui/CaptionPanel.java
index 74e8feb..4f72ebc 100644
--- a/user/src/com/google/gwt/user/client/ui/CaptionPanel.java
+++ b/user/src/com/google/gwt/user/client/ui/CaptionPanel.java
@@ -23,6 +23,8 @@
 import com.google.gwt.dom.client.FieldSetElement;
 import com.google.gwt.dom.client.LegendElement;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 import java.util.Iterator;
 
@@ -41,8 +43,8 @@
       setCaption(fieldset, legend, caption.asString(), true);
     }
 
-    public void setCaption(FieldSetElement fieldset, Element legend,
-        String caption, boolean asHTML) {
+    public void setCaption(
+        FieldSetElement fieldset, Element legend, @IsSafeHtml String caption, boolean asHTML) {
       // TODO(bruce): rewrite to be inlinable
       assert (caption != null);
 
@@ -76,8 +78,11 @@
     }
 
     @Override
-    public void setCaption(final FieldSetElement fieldset, Element legend,
-        String caption, boolean asHTML) {
+    public void setCaption(
+        final FieldSetElement fieldset,
+        Element legend,
+        @IsSafeHtml String caption,
+        boolean asHTML) {
       fieldset.getStyle().setProperty("display", "none");
       super.setCaption(fieldset, legend, caption, asHTML);
       fieldset.getStyle().setProperty("display", "");
@@ -95,8 +100,11 @@
     }
 
     @Override
-    public void setCaption(final FieldSetElement fieldset, Element legend,
-        String caption, boolean asHTML) {
+    public void setCaption(
+        final FieldSetElement fieldset,
+        Element legend,
+        @IsSafeHtml String caption,
+        boolean asHTML) {
       fieldset.getStyle().setProperty("visibility", "hidden");
       super.setCaption(fieldset, legend, caption, asHTML);
       Scheduler.get().scheduleDeferred(new ScheduledCommand() {
@@ -138,6 +146,7 @@
    *
    * @param captionText the text of the caption, which is automatically escaped
    */
+  @SuppressIsSafeHtmlCastCheck
   public CaptionPanel(String captionText) {
     this(captionText, false);
   }
@@ -150,7 +159,7 @@
    *            interpreted as HTML; otherwise, <code>caption</code> is
    *            treated as text and automatically escaped
    */
-  public CaptionPanel(String caption, boolean asHTML) {
+  public CaptionPanel(@IsSafeHtml String caption, boolean asHTML) {
     FieldSetElement fieldSet = Document.get().createFieldSetElement();
     initWidget(new SimplePanel(fieldSet));
     legend = Document.get().createLegendElement();
@@ -245,7 +254,7 @@
    *
    * @param html HTML for the new caption; must not be <code>null</code>
    */
-  public void setCaptionHTML(String html) {
+  public void setCaptionHTML(@IsSafeHtml String html) {
     assert (html != null);
     impl.setCaption(FieldSetElement.as(getElement()), legend, html, true);
   }
@@ -266,6 +275,7 @@
    *
    * @param text text for the new caption; must not be <code>null</code>
    */
+  @SuppressIsSafeHtmlCastCheck
   public void setCaptionText(String text) {
     assert (text != null);
     impl.setCaption(FieldSetElement.as(getElement()), legend, text, false);
diff --git a/user/src/com/google/gwt/user/client/ui/CheckBox.java b/user/src/com/google/gwt/user/client/ui/CheckBox.java
index fb6b4bd..35a4ac0 100644
--- a/user/src/com/google/gwt/user/client/ui/CheckBox.java
+++ b/user/src/com/google/gwt/user/client/ui/CheckBox.java
@@ -32,6 +32,7 @@
 import com.google.gwt.i18n.shared.DirectionEstimator;
 import com.google.gwt.i18n.shared.HasDirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 
@@ -160,11 +161,11 @@
 
   /**
    * Creates a check box with the specified text label.
-   * 
+   *
    * @param label the check box's label
    * @param asHTML <code>true</code> to treat the specified label as html
    */
-  public CheckBox(String label, boolean asHTML) {
+  public CheckBox(@IsSafeHtml String label, boolean asHTML) {
     this();
     if (asHTML) {
       setHTML(label);
@@ -380,7 +381,7 @@
   }
 
   @Override
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     directionalTextHelper.setHtml(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/CustomButton.java b/user/src/com/google/gwt/user/client/ui/CustomButton.java
index a18e6ad..282bf9f 100644
--- a/user/src/com/google/gwt/user/client/ui/CustomButton.java
+++ b/user/src/com/google/gwt/user/client/ui/CustomButton.java
@@ -25,6 +25,7 @@
 import com.google.gwt.event.dom.client.ClickHandler;
 import com.google.gwt.safehtml.client.HasSafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 
@@ -195,7 +196,7 @@
      *
      */
     @Override
-    public void setHTML(String html) {
+    public void setHTML(@IsSafeHtml String html) {
       face = DOM.createDiv();
       UIObject.setStyleName(face, STYLENAME_HTML_FACE, true);
       face.setInnerHTML(html);
@@ -775,7 +776,7 @@
    * @param html html to set
    */
   @Override
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     getCurrentFace().setHTML(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/DialogBox.java b/user/src/com/google/gwt/user/client/ui/DialogBox.java
index f624326..9ac7547 100644
--- a/user/src/com/google/gwt/user/client/ui/DialogBox.java
+++ b/user/src/com/google/gwt/user/client/ui/DialogBox.java
@@ -36,6 +36,7 @@
 import com.google.gwt.safehtml.client.HasSafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtmlUtils;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 import com.google.gwt.user.client.Event.NativePreviewEvent;
@@ -404,7 +405,7 @@
    *
    * @param html the object's new HTML
    */
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     caption.setHTML(SafeHtmlUtils.fromTrustedString(html));
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/DirectionalTextHelper.java b/user/src/com/google/gwt/user/client/ui/DirectionalTextHelper.java
index 519d37d..e2a51a7 100644
--- a/user/src/com/google/gwt/user/client/ui/DirectionalTextHelper.java
+++ b/user/src/com/google/gwt/user/client/ui/DirectionalTextHelper.java
@@ -23,6 +23,8 @@
 import com.google.gwt.i18n.shared.HasDirectionEstimator;
 import com.google.gwt.i18n.shared.WordCountDirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 /**
  * A helper class for displaying bidi (i.e. potentially opposite-direction) text 
@@ -151,15 +153,16 @@
    * @deprecated
    */
   @Deprecated
+  @SuppressIsSafeHtmlCastCheck
   public void setDirection(Direction direction) {
     BidiUtils.setDirectionOnElement(element, direction);
     initialElementDir = direction;
 
-    /* 
+    /*
      * For backwards compatibility, assure there's no span wrap, and update the
      * content direction.
      */
-    setInnerTextOrHtml(getHtml(), true);
+    setInnerTextOrHtml(getHtml(), true); // TODO: mXSS?
     isSpanWrapped = false;
     textDir = initialElementDir;
     isDirectionExplicitlySet = true;
@@ -179,6 +182,7 @@
    * flicker, and thus should be avoided; DirectionEstimator should be set
    * before the element has any content.
    */
+  @SuppressIsSafeHtmlCastCheck
   public void setDirectionEstimator(DirectionEstimator directionEstimator) {
     this.directionEstimator = directionEstimator;
     /* 
@@ -186,7 +190,7 @@
      * setTextOrHtml call.
      */
     if (!isDirectionExplicitlySet) {
-      setHtml(getHtml());
+      setHtml(getHtml()); // TODO: mXSS
     }
   }
 
@@ -200,6 +204,7 @@
    *
    * @param content the element's new content
    */
+  @SuppressIsSafeHtmlCastCheck
   public void setText(String content) {
     setTextOrHtml(content, false /* isHtml */);
   }
@@ -228,7 +233,7 @@
    *
    * @param content the element's new content
    */
-  public void setHtml(String content) {
+  public void setHtml(@IsSafeHtml String content) {
     setTextOrHtml(content, true /* isHtml */);
   }
 
@@ -240,7 +245,7 @@
    * @param content the element's new content
    * @param isHtml whether the content is HTML
    */
-  public void setTextOrHtml(String content, boolean isHtml) {
+  public void setTextOrHtml(@IsSafeHtml String content, boolean isHtml) {
     if (directionEstimator == null) {
       isSpanWrapped = false;
       setInnerTextOrHtml(content, isHtml);
@@ -281,6 +286,7 @@
    * @param content the element's new content
    * @param dir the content's direction
    */
+  @SuppressIsSafeHtmlCastCheck
   public void setText(String content, Direction dir) {
     setTextOrHtml(content, dir, false /* isHtml */);
   }
@@ -329,7 +335,7 @@
    * @param content the element's new content
    * @param dir the content's direction
    */
-  public void setHtml(String content, Direction dir) {
+  public void setHtml(@IsSafeHtml String content, Direction dir) {
     setTextOrHtml(content, dir, true /* isHtml */);
   }
 
@@ -344,7 +350,7 @@
    * @param dir the content's direction
    * @param isHtml whether the content is HTML
    */
-  public void setTextOrHtml(String content, Direction dir, boolean isHtml) {
+  public void setTextOrHtml(@IsSafeHtml String content, Direction dir, boolean isHtml) {
     textDir = dir;
     // Set the text and the direction.
     if (isElementInline) {
@@ -359,7 +365,7 @@
     isDirectionExplicitlySet = true;
   }
 
-  private void setInnerTextOrHtml(String content, boolean isHtml) {
+  private void setInnerTextOrHtml(@IsSafeHtml String content, boolean isHtml) {
     if (isHtml) {
       element.setInnerHTML(content);
     } else {
diff --git a/user/src/com/google/gwt/user/client/ui/HTML.java b/user/src/com/google/gwt/user/client/ui/HTML.java
index cfb9bf1..25dc24a 100644
--- a/user/src/com/google/gwt/user/client/ui/HTML.java
+++ b/user/src/com/google/gwt/user/client/ui/HTML.java
@@ -19,6 +19,7 @@
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.i18n.shared.DirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * A widget that can contain arbitrary HTML.
@@ -126,7 +127,7 @@
    *
    * @param html the new widget's HTML contents
    */
-  public HTML(String html) {
+  public HTML(@IsSafeHtml String html) {
     this();
     setHTML(html);
   }
@@ -139,7 +140,7 @@
    * @param dir the content's direction. Note: {@code Direction.DEFAULT} means
    *        direction should be inherited from the widget's parent element.
    */
-  public HTML(String html, Direction dir) {
+  public HTML(@IsSafeHtml String html, Direction dir) {
     this();
     setHTML(html, dir);
   }
@@ -151,7 +152,7 @@
    * @param html the widget's contents
    * @param wordWrap <code>false</code> to disable word wrapping
    */
-  public HTML(String html, boolean wordWrap) {
+  public HTML(@IsSafeHtml String html, boolean wordWrap) {
     this(html);
     setWordWrap(wordWrap);
   }
@@ -179,7 +180,7 @@
    *
    * @param html the new widget's HTML content
    */
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     directionalTextHelper.setHtml(html);
     updateHorizontalAlignment();
   }
@@ -189,12 +190,12 @@
    * See
    * {@link #setText(String, com.google.gwt.i18n.client.HasDirection.Direction) setText(String, Direction)}
    * for details on potential effects on alignment.
-   * 
+   *
    * @param html the new widget's HTML content
    * @param dir the content's direction. Note: {@code Direction.DEFAULT} means
    *          direction should be inherited from the widget's parent element.
    */
-  public void setHTML(String html, Direction dir) {
+  public void setHTML(@IsSafeHtml String html, Direction dir) {
     directionalTextHelper.setHtml(html, dir);
     updateHorizontalAlignment();
   }
diff --git a/user/src/com/google/gwt/user/client/ui/HTMLPanel.java b/user/src/com/google/gwt/user/client/ui/HTMLPanel.java
index a4301e2..580f081 100644
--- a/user/src/com/google/gwt/user/client/ui/HTMLPanel.java
+++ b/user/src/com/google/gwt/user/client/ui/HTMLPanel.java
@@ -19,6 +19,8 @@
 import com.google.gwt.dom.client.Document;
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 import com.google.gwt.user.client.DOM;
 
 import java.util.Iterator;
@@ -72,7 +74,7 @@
    *
    * @param html the panel's HTML
    */
-  public HTMLPanel(String html) {
+  public HTMLPanel(@IsSafeHtml String html) {
     /*
      * Normally would call this("div", html), but that method
      * has some slightly expensive IE defensiveness that we just
@@ -101,7 +103,8 @@
    * @param tag the tag of the root element
    * @param html the panel's HTML
    */
-  public HTMLPanel(String tag, String html) {
+  @SuppressIsSafeHtmlCastCheck
+  public HTMLPanel(String tag, @IsSafeHtml String html) {
     // Optimization for when the HTML is empty.
     if ("".equals(html)) {
       setElement(Document.get().createElement(tag));
diff --git a/user/src/com/google/gwt/user/client/ui/HTMLTable.java b/user/src/com/google/gwt/user/client/ui/HTMLTable.java
index b77b2e8..924d472 100644
--- a/user/src/com/google/gwt/user/client/ui/HTMLTable.java
+++ b/user/src/com/google/gwt/user/client/ui/HTMLTable.java
@@ -44,6 +44,7 @@
 import com.google.gwt.event.dom.client.HasDoubleClickHandlers;
 import com.google.gwt.event.shared.HandlerRegistration;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 import com.google.gwt.user.client.impl.ElementMapperImpl;
@@ -1135,13 +1136,13 @@
 
   /**
    * Sets the HTML contents of the specified cell.
-   * 
+   *
    * @param row the cell's row
    * @param column the cell's column
    * @param html the cell's HTML contents
    * @throws IndexOutOfBoundsException
    */
-  public void setHTML(int row, int column, String html) {
+  public void setHTML(int row, int column, @IsSafeHtml String html) {
     prepareCell(row, column);
     Element td = cleanCell(row, column, html == null);
     if (html != null) {
diff --git a/user/src/com/google/gwt/user/client/ui/HasDirectionalHtml.java b/user/src/com/google/gwt/user/client/ui/HasDirectionalHtml.java
index 5d8b573..a99e917 100644
--- a/user/src/com/google/gwt/user/client/ui/HasDirectionalHtml.java
+++ b/user/src/com/google/gwt/user/client/ui/HasDirectionalHtml.java
@@ -15,7 +15,8 @@
  */
 package com.google.gwt.user.client.ui;
 
-import com.google.gwt.i18n.client.HasDirection.Direction; 
+import com.google.gwt.i18n.client.HasDirection.Direction;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * An object that implements this interface contains html that has a direction.
@@ -27,5 +28,5 @@
    * @param html the object's new html
    * @param dir the html's direction
    */
-  void setHTML(String html, Direction dir);
+  void setHTML(@IsSafeHtml String html, Direction dir);
 }
diff --git a/user/src/com/google/gwt/user/client/ui/HasHTML.java b/user/src/com/google/gwt/user/client/ui/HasHTML.java
index 561b249..34433aa 100644
--- a/user/src/com/google/gwt/user/client/ui/HasHTML.java
+++ b/user/src/com/google/gwt/user/client/ui/HasHTML.java
@@ -15,6 +15,8 @@
  */
 package com.google.gwt.user.client.ui;
 
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+
 /**
  * An object that implements this interface contains text, which can be set and
  * retrieved using these methods. The object's text can be set either as HTML or
@@ -43,8 +45,8 @@
    * Sets this object's contents via HTML. Use care when setting an object's
    * HTML; it is an easy way to expose script-based security problems. Consider
    * using {@link #setText(String)} whenever possible.
-   * 
+   *
    * @param html the object's new HTML
    */
-  void setHTML(String html);
+  void setHTML(@IsSafeHtml String html);
 }
diff --git a/user/src/com/google/gwt/user/client/ui/Hyperlink.java b/user/src/com/google/gwt/user/client/ui/Hyperlink.java
index 7f6fdd6..2ec1102 100644
--- a/user/src/com/google/gwt/user/client/ui/Hyperlink.java
+++ b/user/src/com/google/gwt/user/client/ui/Hyperlink.java
@@ -25,6 +25,8 @@
 import com.google.gwt.i18n.shared.DirectionEstimator;
 import com.google.gwt.i18n.shared.HasDirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 import com.google.gwt.user.client.History;
@@ -136,26 +138,28 @@
    *          may not be null (use {@link Anchor} instead if you don't need
    *          history processing)
    */
+  @SuppressIsSafeHtmlCastCheck
   public Hyperlink(String text, String targetHistoryToken) {
     this(text, false, targetHistoryToken);
   }
 
   /**
    * Creates a hyperlink with its text and target history token specified.
-   * 
+   *
    * @param text the hyperlink's text
    * @param dir the text's direction
    * @param targetHistoryToken the history token to which it will link, which
    *          may not be null (use {@link Anchor} instead if you don't need
    *          history processing)
    */
+  @SuppressIsSafeHtmlCastCheck
   public Hyperlink(String text, Direction dir, String targetHistoryToken) {
     this(text, false, dir, targetHistoryToken);
   }
 
   /**
    * Creates a hyperlink with its text and target history token specified.
-   * 
+   *
    * @param text the hyperlink's text
    * @param directionEstimator A DirectionEstimator object used for automatic
    *          direction adjustment. For convenience,
@@ -164,8 +168,8 @@
    *          may not be null (use {@link Anchor} instead if you don't need
    *          history processing)
    */
-  public Hyperlink(String text, DirectionEstimator directionEstimator,
-      String targetHistoryToken) {
+  @SuppressIsSafeHtmlCastCheck
+  public Hyperlink(String text, DirectionEstimator directionEstimator, String targetHistoryToken) {
     this(text, false, directionEstimator, targetHistoryToken);
   }
 
@@ -177,7 +181,7 @@
    * @param targetHistoryToken the history token to which it will link
    * @see #setTargetHistoryToken
    */
-  public Hyperlink(String text, boolean asHTML, String targetHistoryToken) {
+  public Hyperlink(@IsSafeHtml String text, boolean asHTML, String targetHistoryToken) {
     this();
     directionalTextHelper.setTextOrHtml(text, asHTML);
     setTargetHistoryToken(targetHistoryToken);
@@ -206,8 +210,8 @@
    * @param targetHistoryToken the history token to which it will link
    * @see #setTargetHistoryToken
    */
-  private Hyperlink(String text, boolean asHTML, Direction dir,
-      String targetHistoryToken) {
+  private Hyperlink(
+      @IsSafeHtml String text, boolean asHTML, Direction dir, String targetHistoryToken) {
     this();
     directionalTextHelper.setTextOrHtml(text, dir, asHTML);
     setTargetHistoryToken(targetHistoryToken);
@@ -224,8 +228,11 @@
    * @param targetHistoryToken the history token to which it will link
    * @see #setTargetHistoryToken
    */
-  private Hyperlink(String text, boolean asHTML,
-      DirectionEstimator directionEstimator, String targetHistoryToken) {
+  private Hyperlink(
+      @IsSafeHtml String text,
+      boolean asHTML,
+      DirectionEstimator directionEstimator,
+      String targetHistoryToken) {
     this();
     directionalTextHelper.setDirectionEstimator(directionEstimator);
     directionalTextHelper.setTextOrHtml(text, asHTML);
@@ -322,7 +329,7 @@
     setHTML(html.asString());
   }
 
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     directionalTextHelper.setHtml(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/InlineHTML.java b/user/src/com/google/gwt/user/client/ui/InlineHTML.java
index ce10ab4..625f274 100644
--- a/user/src/com/google/gwt/user/client/ui/InlineHTML.java
+++ b/user/src/com/google/gwt/user/client/ui/InlineHTML.java
@@ -19,6 +19,7 @@
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.i18n.shared.DirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * A widget that can contain arbitrary HTML.
@@ -120,7 +121,7 @@
    *
    * @param html the new widget's HTML contents
    */
-  public InlineHTML(String html) {
+  public InlineHTML(@IsSafeHtml String html) {
     this();
     setHTML(html);
   }
@@ -133,7 +134,7 @@
    * @param dir the content's direction. Note: {@code Direction.DEFAULT} means
    *        direction should be inherited from the widget's parent element.
    */
-  public InlineHTML(String html, Direction dir) {
+  public InlineHTML(@IsSafeHtml String html, Direction dir) {
     this();
     setHTML(html, dir);
   }
diff --git a/user/src/com/google/gwt/user/client/ui/InlineHyperlink.java b/user/src/com/google/gwt/user/client/ui/InlineHyperlink.java
index 43b20be..f0ef9d0 100644
--- a/user/src/com/google/gwt/user/client/ui/InlineHyperlink.java
+++ b/user/src/com/google/gwt/user/client/ui/InlineHyperlink.java
@@ -19,6 +19,8 @@
 import com.google.gwt.i18n.client.HasDirection.Direction;
 import com.google.gwt.i18n.shared.DirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 /**
  * A widget that serves as an "internal" hyperlink. That is, it is a link to
@@ -91,37 +93,39 @@
 
   /**
    * Creates a hyperlink with its text and target history token specified.
-   * 
+   *
    * @param text the hyperlink's text
    * @param targetHistoryToken the history token to which it will link
    */
+  @SuppressIsSafeHtmlCastCheck
   public InlineHyperlink(String text, String targetHistoryToken) {
     this(text, false, targetHistoryToken);
   }
 
   /**
    * Creates a hyperlink with its text and target history token specified.
-   * 
+   *
    * @param text the hyperlink's text
    * @param dir the text's direction
    * @param targetHistoryToken the history token to which it will link
    */
-  public InlineHyperlink(String text, Direction dir,
-      String targetHistoryToken) {
+  @SuppressIsSafeHtmlCastCheck
+  public InlineHyperlink(String text, Direction dir, String targetHistoryToken) {
     this(text, false, dir, targetHistoryToken);
   }
 
   /**
    * Creates a hyperlink with its text and target history token specified.
-   * 
+   *
    * @param text the hyperlink's text
    * @param directionEstimator A DirectionEstimator object used for automatic
    *          direction adjustment. For convenience,
    *          {@link Hyperlink#DEFAULT_DIRECTION_ESTIMATOR} can be used.
    * @param targetHistoryToken the history token to which it will link
    */
-  public InlineHyperlink(String text, DirectionEstimator directionEstimator,
-      String targetHistoryToken) {
+  @SuppressIsSafeHtmlCastCheck
+  public InlineHyperlink(
+      String text, DirectionEstimator directionEstimator, String targetHistoryToken) {
     this(text, false, directionEstimator, targetHistoryToken);
   }
 
@@ -133,8 +137,7 @@
    * @param targetHistoryToken the history token to which it will link
    * @see #setTargetHistoryToken
    */
-  public InlineHyperlink(String text, boolean asHTML,
-      String targetHistoryToken) {
+  public InlineHyperlink(@IsSafeHtml String text, boolean asHTML, String targetHistoryToken) {
     this();
     directionalTextHelper.setTextOrHtml(text, asHTML);
     setTargetHistoryToken(targetHistoryToken);
@@ -149,8 +152,8 @@
    * @param targetHistoryToken the history token to which it will link
    * @see #setTargetHistoryToken
    */
-  private InlineHyperlink(String text, boolean asHTML, Direction dir,
-      String targetHistoryToken) {
+  private InlineHyperlink(
+      @IsSafeHtml String text, boolean asHTML, Direction dir, String targetHistoryToken) {
     this();
     directionalTextHelper.setTextOrHtml(text, dir, asHTML);
     setTargetHistoryToken(targetHistoryToken);
@@ -167,8 +170,11 @@
    * @param targetHistoryToken the history token to which it will link
    * @see #setTargetHistoryToken
    */
-  private InlineHyperlink(String text, boolean asHTML,
-      DirectionEstimator directionEstimator, String targetHistoryToken) {
+  private InlineHyperlink(
+      @IsSafeHtml String text,
+      boolean asHTML,
+      DirectionEstimator directionEstimator,
+      String targetHistoryToken) {
     this();
     directionalTextHelper.setDirectionEstimator(directionEstimator);
     directionalTextHelper.setTextOrHtml(text, asHTML);
diff --git a/user/src/com/google/gwt/user/client/ui/MenuBar.java b/user/src/com/google/gwt/user/client/ui/MenuBar.java
index 7b041b9..7d827e8 100644
--- a/user/src/com/google/gwt/user/client/ui/MenuBar.java
+++ b/user/src/com/google/gwt/user/client/ui/MenuBar.java
@@ -34,6 +34,7 @@
 import com.google.gwt.resources.client.ImageResource;
 import com.google.gwt.resources.client.ImageResource.ImageOptions;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 import com.google.gwt.user.client.Event.NativePreviewEvent;
@@ -403,7 +404,7 @@
    * @param cmd the command to be fired
    * @return the {@link MenuItem} object created
    */
-  public MenuItem addItem(String text, boolean asHTML, ScheduledCommand cmd) {
+  public MenuItem addItem(@IsSafeHtml String text, boolean asHTML, ScheduledCommand cmd) {
     return addItem(new MenuItem(text, asHTML, cmd));
   }
 
@@ -428,7 +429,7 @@
    * @param popup the menu to be cascaded from it
    * @return the {@link MenuItem} object created
    */
-  public MenuItem addItem(String text, boolean asHTML, MenuBar popup) {
+  public MenuItem addItem(@IsSafeHtml String text, boolean asHTML, MenuBar popup) {
     return addItem(new MenuItem(text, asHTML, popup));
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/MenuItem.java b/user/src/com/google/gwt/user/client/ui/MenuItem.java
index 52e538d..898941f 100644
--- a/user/src/com/google/gwt/user/client/ui/MenuItem.java
+++ b/user/src/com/google/gwt/user/client/ui/MenuItem.java
@@ -19,6 +19,8 @@
 import com.google.gwt.core.client.Scheduler.ScheduledCommand;
 import com.google.gwt.safehtml.client.HasSafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 import com.google.gwt.user.client.Command;
 import com.google.gwt.user.client.DOM;
 
@@ -76,7 +78,7 @@
    * @param asHTML <code>true</code> to treat the specified text as html
    * @param cmd the command to be fired when it is selected
    */
-  public MenuItem(String text, boolean asHTML, ScheduledCommand cmd) {
+  public MenuItem(@IsSafeHtml String text, boolean asHTML, ScheduledCommand cmd) {
     this(text, asHTML);
     setScheduledCommand(cmd);
   }
@@ -88,7 +90,7 @@
    * @param asHTML <code>true</code> to treat the specified text as html
    * @param subMenu the sub-menu to be displayed when it is selected
    */
-  public MenuItem(String text, boolean asHTML, MenuBar subMenu) {
+  public MenuItem(@IsSafeHtml String text, boolean asHTML, MenuBar subMenu) {
     this(text, asHTML);
     setSubMenu(subMenu);
   }
@@ -99,6 +101,7 @@
    * @param text the item's text
    * @param cmd the command to be fired when it is selected
    */
+  @SuppressIsSafeHtmlCastCheck
   public MenuItem(String text, ScheduledCommand cmd) {
     this(text, false);
     setScheduledCommand(cmd);
@@ -110,12 +113,13 @@
    * @param text the item's text
    * @param subMenu the sub-menu to be displayed when it is selected
    */
+  @SuppressIsSafeHtmlCastCheck
   public MenuItem(String text, MenuBar subMenu) {
     this(text, false);
     setSubMenu(subMenu);
   }
 
-  MenuItem(String text, boolean asHTML) {
+  MenuItem(@IsSafeHtml String text, boolean asHTML) {
     setElement(DOM.createTD());
     setSelectionStyle(false);
 
@@ -230,7 +234,7 @@
   }
 
   @Override
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     getElement().setInnerHTML(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java b/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
index 742037e..1645225 100644
--- a/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
+++ b/user/src/com/google/gwt/user/client/ui/MultiWordSuggestOracle.java
@@ -17,6 +17,7 @@
 
 import com.google.gwt.safehtml.shared.SafeHtmlBuilder;
 import com.google.gwt.safehtml.shared.SafeHtmlUtils;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.rpc.IsSerializable;
 
 import java.util.ArrayList;
@@ -71,7 +72,7 @@
    * Suggestion class for {@link MultiWordSuggestOracle}.
    */
   public static class MultiWordSuggestion implements Suggestion, IsSerializable {
-    private String displayString;
+    @IsSafeHtml private String displayString;
     private String replacementString;
 
     /**
@@ -87,11 +88,12 @@
      *          box if the suggestion is chosen
      * @param displayString the display string
      */
-    public MultiWordSuggestion(String replacementString, String displayString) {
+    public MultiWordSuggestion(String replacementString, @IsSafeHtml String displayString) {
       this.replacementString = replacementString;
       this.displayString = displayString;
     }
-
+    
+    @IsSafeHtml
     public String getDisplayString() {
       return displayString;
     }
@@ -347,8 +349,8 @@
    *
    * @return the suggestion created
    */
-  protected MultiWordSuggestion createSuggestion(String replacementString,
-      String displayString) {
+  protected MultiWordSuggestion createSuggestion(
+      String replacementString, @IsSafeHtml String displayString) {
     return new MultiWordSuggestion(replacementString, displayString);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/RadioButton.java b/user/src/com/google/gwt/user/client/ui/RadioButton.java
index 4730224..6b3a5a0 100644
--- a/user/src/com/google/gwt/user/client/ui/RadioButton.java
+++ b/user/src/com/google/gwt/user/client/ui/RadioButton.java
@@ -21,6 +21,7 @@
 import com.google.gwt.i18n.client.HasDirection.Direction;
 import com.google.gwt.i18n.shared.DirectionEstimator;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.uibinder.client.UiConstructor;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
@@ -178,15 +179,15 @@
    * initialized with the given label (optionally treated as HTML). All radio
    * buttons associated with the same group name belong to a mutually-exclusive
    * set.
-   * 
+   *
    * Radio buttons are grouped by their name attribute, so changing their name
    * using the setName() method will also change their associated group.
-   * 
+   *
    * @param name name the group with which to associate the radio button
    * @param label this radio button's label
    * @param asHTML <code>true</code> to treat the specified label as HTML
    */
-  public RadioButton(String name, String label, boolean asHTML) {
+  public RadioButton(String name, @IsSafeHtml String label, boolean asHTML) {
     this(name);
     if (asHTML) {
       setHTML(label);
diff --git a/user/src/com/google/gwt/user/client/ui/RenderablePanel.java b/user/src/com/google/gwt/user/client/ui/RenderablePanel.java
index c59eef1..22d3bdc 100644
--- a/user/src/com/google/gwt/user/client/ui/RenderablePanel.java
+++ b/user/src/com/google/gwt/user/client/ui/RenderablePanel.java
@@ -21,6 +21,7 @@
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.safehtml.shared.SafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtmlBuilder;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 
 /**
@@ -65,7 +66,7 @@
    *
    * @param html the panel's HTML
    */
-  public RenderablePanel(String html) {
+  public RenderablePanel(@IsSafeHtml String html) {
     this(new SafeHtmlBuilder().appendHtmlConstant(html).toSafeHtml());
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/ResetButton.java b/user/src/com/google/gwt/user/client/ui/ResetButton.java
index cc02323..59ef767 100644
--- a/user/src/com/google/gwt/user/client/ui/ResetButton.java
+++ b/user/src/com/google/gwt/user/client/ui/ResetButton.java
@@ -19,6 +19,7 @@
 import com.google.gwt.dom.client.Document;
 import com.google.gwt.event.dom.client.ClickHandler;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * A standard push-button widget which will automatically reset its enclosing
@@ -76,7 +77,7 @@
    *
    * @param html the HTML caption
    */
-  public ResetButton(String html) {
+  public ResetButton(@IsSafeHtml String html) {
     this();
     setHTML(html);
   }
@@ -97,7 +98,7 @@
    * @param html the HTML caption
    * @param handler the click handler
    */
-  public ResetButton(String html, ClickHandler handler) {
+  public ResetButton(@IsSafeHtml String html, ClickHandler handler) {
     this(html);
     addClickHandler(handler);
   }
diff --git a/user/src/com/google/gwt/user/client/ui/RichTextArea.java b/user/src/com/google/gwt/user/client/ui/RichTextArea.java
index e174aa2..f08f1f5 100644
--- a/user/src/com/google/gwt/user/client/ui/RichTextArea.java
+++ b/user/src/com/google/gwt/user/client/ui/RichTextArea.java
@@ -22,6 +22,7 @@
 import com.google.gwt.event.shared.HandlerRegistration;
 import com.google.gwt.safehtml.client.HasSafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.ui.impl.RichTextAreaImpl;
 
 /**
@@ -369,10 +370,10 @@
 
     /**
      * Inserts generic html.
-     * 
+     *
      * @param html the HTML to insert
      */
-    void insertHTML(String html);
+    void insertHTML(@IsSafeHtml String html);
 
     /**
      * Inserts an image element.
@@ -654,7 +655,7 @@
     }
   }
 
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     impl.setHTML(html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/StackLayoutPanel.java b/user/src/com/google/gwt/user/client/ui/StackLayoutPanel.java
index e567de9..6caf7cd 100644
--- a/user/src/com/google/gwt/user/client/ui/StackLayoutPanel.java
+++ b/user/src/com/google/gwt/user/client/ui/StackLayoutPanel.java
@@ -32,6 +32,8 @@
 import com.google.gwt.event.shared.HandlerRegistration;
 import com.google.gwt.layout.client.Layout.AnimationCallback;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 import java.util.ArrayList;
 import java.util.Iterator;
@@ -172,22 +174,24 @@
   /**
    * Adds a child widget to this stack, along with a widget representing the
    * stack header.
-   * 
+   *
    * @param widget the child widget to be added
    * @param header the text to be shown on its header
    * @param asHtml <code>true</code> to treat the specified text as HTML
    * @param headerSize the size of the header widget
    */
-  public void add(final Widget widget, String header, boolean asHtml, double headerSize) {
+  public void add(
+      final Widget widget, @IsSafeHtml String header, boolean asHtml, double headerSize) {
     insert(widget, header, asHtml, headerSize, getWidgetCount());
   }
   
   /**
    * Overloaded version for IsWidget.
-   * 
+   *
    * @see #add(Widget,String,boolean,double)
    */
-  public void add(final IsWidget widget, String header, boolean asHtml, double headerSize) {
+  public void add(
+      final IsWidget widget, @IsSafeHtml String header, boolean asHtml, double headerSize) {
     this.add(widget.asWidget(), header, asHtml, headerSize);
   }
 
@@ -376,15 +380,15 @@
   /**
    * Inserts a widget into the panel. If the Widget is already attached, it will
    * be moved to the requested index.
-   * 
+   *
    * @param child the widget to be added
    * @param text the text to be shown on its header
    * @param asHtml <code>true</code> to treat the specified text as HTML
    * @param headerSize the size of the header widget
    * @param beforeIndex the index before which it will be inserted
    */
-  public void insert(Widget child, String text, boolean asHtml,
-      double headerSize, int beforeIndex) {
+  public void insert(
+      Widget child, @IsSafeHtml String text, boolean asHtml, double headerSize, int beforeIndex) {
     HTML contents = new HTML();
     if (asHtml) {
       contents.setHTML(text);
@@ -403,6 +407,7 @@
    * @param headerSize the size of the header widget
    * @param beforeIndex the index before which it will be inserted
    */
+  @SuppressIsSafeHtmlCastCheck
   public void insert(Widget child, String text, double headerSize, int beforeIndex) {
     insert(child, text, false, headerSize, beforeIndex);
   }
@@ -506,13 +511,13 @@
    *
    * Use care when setting an object's HTML; it is an easy way to expose
    * script-based security problems. Consider using
-   * {@link #setHeaderHTML(int, SafeHtml)} or 
+   * {@link #setHeaderHTML(int, SafeHtml)} or
    * {@link #setHeaderText(int, String)} whenever possible.
    *
    * @param index the index of the header whose HTML is to be set
    * @param html the header's new HTML contents
    */
-  public void setHeaderHTML(int index, String html) {
+  public void setHeaderHTML(int index, @IsSafeHtml String html) {
     checkIndex(index);
     LayoutData data = layoutData.get(index);
 
diff --git a/user/src/com/google/gwt/user/client/ui/StackPanel.java b/user/src/com/google/gwt/user/client/ui/StackPanel.java
index 009e443..8015dd7 100644
--- a/user/src/com/google/gwt/user/client/ui/StackPanel.java
+++ b/user/src/com/google/gwt/user/client/ui/StackPanel.java
@@ -17,6 +17,8 @@
 
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 
@@ -83,6 +85,7 @@
    * @param w the widget to be added
    * @param stackText the header text associated with this widget
    */
+  @SuppressIsSafeHtmlCastCheck
   public void add(Widget w, String stackText) {
     add(w, stackText, false);
   }
@@ -106,7 +109,7 @@
    * @param stackText the header text associated with this widget
    * @param asHTML <code>true</code> to treat the specified text as HTML
    */
-  public void add(Widget w, String stackText, boolean asHTML) {
+  public void add(Widget w, @IsSafeHtml String stackText, boolean asHTML) {
     add(w);
     setStackText(getWidgetCount() - 1, stackText, asHTML);
   }
@@ -202,6 +205,7 @@
    * @param index the index of the child whose text is to be set
    * @param text the text to be associated with it
    */
+  @SuppressIsSafeHtmlCastCheck
   public void setStackText(int index, String text) {
     setStackText(index, text, false);
   }
@@ -223,7 +227,7 @@
    * @param text the text to be associated with it
    * @param asHTML <code>true</code> to treat the specified text as HTML
    */
-  public void setStackText(int index, String text, boolean asHTML) {
+  public void setStackText(int index, @IsSafeHtml String text, boolean asHTML) {
     if (index >= getWidgetCount()) {
       return;
     }
diff --git a/user/src/com/google/gwt/user/client/ui/SubmitButton.java b/user/src/com/google/gwt/user/client/ui/SubmitButton.java
index 07223f4..82a770e 100644
--- a/user/src/com/google/gwt/user/client/ui/SubmitButton.java
+++ b/user/src/com/google/gwt/user/client/ui/SubmitButton.java
@@ -19,6 +19,7 @@
 import com.google.gwt.dom.client.Document;
 import com.google.gwt.event.dom.client.ClickHandler;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * A standard push-button widget which will automatically submit its enclosing
@@ -78,7 +79,7 @@
    *
    * @param html the HTML caption
    */
-  public SubmitButton(String html) {
+  public SubmitButton(@IsSafeHtml String html) {
     this();
     setHTML(html);
   }
@@ -99,7 +100,7 @@
    * @param html the HTML caption
    * @param handler the click handler
    */
-  public SubmitButton(String html, ClickHandler handler) {
+  public SubmitButton(@IsSafeHtml String html, ClickHandler handler) {
     this(html);
     addClickHandler(handler);
   }
diff --git a/user/src/com/google/gwt/user/client/ui/SuggestOracle.java b/user/src/com/google/gwt/user/client/ui/SuggestOracle.java
index 11f59c9..6fb732b 100644
--- a/user/src/com/google/gwt/user/client/ui/SuggestOracle.java
+++ b/user/src/com/google/gwt/user/client/ui/SuggestOracle.java
@@ -15,6 +15,7 @@
  */
 package com.google.gwt.user.client.ui;
 
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.rpc.IsSerializable;
 
 import java.util.ArrayList;
@@ -277,9 +278,10 @@
      * Gets the display string associated with this suggestion. The
      * interpretation of the display string depends upon the value of its
      * oracle's {@link SuggestOracle#isDisplayStringHTML()}.
-     * 
+     *
      * @return the display string for this suggestion
      */
+    @IsSafeHtml
     String getDisplayString();
 
     /**
diff --git a/user/src/com/google/gwt/user/client/ui/TabBar.java b/user/src/com/google/gwt/user/client/ui/TabBar.java
index d57cb6d..eaa64f8 100644
--- a/user/src/com/google/gwt/user/client/ui/TabBar.java
+++ b/user/src/com/google/gwt/user/client/ui/TabBar.java
@@ -35,8 +35,11 @@
 import com.google.gwt.event.logical.shared.SelectionHandler;
 import com.google.gwt.event.shared.HandlerRegistration;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
+
 /**
  * A horizontal bar of folder-style tabs, most commonly used as part of a
  * {@link com.google.gwt.user.client.ui.TabPanel}.
@@ -255,7 +258,7 @@
    * @param text the new tab's text
    * @param asHTML <code>true</code> to treat the specified text as html
    */
-  public void addTab(String text, boolean asHTML) {
+  public void addTab(@IsSafeHtml String text, boolean asHTML) {
     insertTab(text, asHTML, getTabCount());
   }
 
@@ -357,7 +360,7 @@
    * @param asHTML <code>true</code> to treat the specified text as HTML
    * @param beforeIndex the index before which this tab will be inserted
    */
-  public void insertTab(String text, boolean asHTML, int beforeIndex) {
+  public void insertTab(@IsSafeHtml String text, boolean asHTML, int beforeIndex) {
     checkInsertBeforeTabIndex(beforeIndex);
 
     Label item;
@@ -377,6 +380,7 @@
    * @param text the new tab's text
    * @param beforeIndex the index before which this tab will be inserted
    */
+  @SuppressIsSafeHtmlCastCheck
   public void insertTab(String text, int beforeIndex) {
     insertTab(text, false, beforeIndex);
   }
@@ -544,7 +548,7 @@
    * @param index the index of the tab whose HTML is to be set
    * @param html the tab new HTML
    */
-  public void setTabHTML(int index, String html) {
+  public void setTabHTML(int index, @IsSafeHtml String html) {
     assert (index >= 0) && (index < getTabCount()) : "Tab index out of bounds";
 
     ClickDelegatePanel delPanel = (ClickDelegatePanel) panel.getWidget(index + 1);
diff --git a/user/src/com/google/gwt/user/client/ui/TabLayoutPanel.java b/user/src/com/google/gwt/user/client/ui/TabLayoutPanel.java
index 0c90414..aaf9f86 100644
--- a/user/src/com/google/gwt/user/client/ui/TabLayoutPanel.java
+++ b/user/src/com/google/gwt/user/client/ui/TabLayoutPanel.java
@@ -31,6 +31,8 @@
 import com.google.gwt.layout.client.Layout.AnimationCallback;
 import com.google.gwt.resources.client.CommonResources;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 import java.util.ArrayList;
 import java.util.Iterator;
@@ -275,7 +277,7 @@
   /**
    * Convenience overload to allow {@link IsWidget} to be used directly.
    */
-  public void add(IsWidget w, String text, boolean asHtml) {
+  public void add(IsWidget w, @IsSafeHtml String text, boolean asHtml) {
     add(asWidgetOrNull(w), text, asHtml);
   }
 
@@ -313,7 +315,7 @@
    * @param text the text to be shown on its tab
    * @param asHtml <code>true</code> to treat the specified text as HTML
    */
-  public void add(Widget child, String text, boolean asHtml) {
+  public void add(Widget child, @IsSafeHtml String text, boolean asHtml) {
     insert(child, text, asHtml, getWidgetCount());
   }
 
@@ -450,7 +452,7 @@
   /**
    * Convenience overload to allow {@link IsWidget} to be used directly.
    */
-  public void insert(IsWidget child, String text, boolean asHtml, int beforeIndex) {
+  public void insert(IsWidget child, @IsSafeHtml String text, boolean asHtml, int beforeIndex) {
     insert(asWidgetOrNull(child), text, asHtml, beforeIndex);
   }
 
@@ -493,7 +495,7 @@
    * @param asHtml <code>true</code> to treat the specified text as HTML
    * @param beforeIndex the index before which it will be inserted
    */
-  public void insert(Widget child, String text, boolean asHtml, int beforeIndex) {
+  public void insert(Widget child, @IsSafeHtml String text, boolean asHtml, int beforeIndex) {
     Widget contents;
     if (asHtml) {
       contents = new HTML(text);
@@ -511,6 +513,7 @@
    * @param text the text to be shown on its tab
    * @param beforeIndex the index before which it will be inserted
    */
+  @SuppressIsSafeHtmlCastCheck
   public void insert(Widget child, String text, int beforeIndex) {
     insert(child, text, false, beforeIndex);
   }
@@ -686,7 +689,7 @@
    * @param index the index of the tab whose HTML is to be set
    * @param html the tab's new HTML contents
    */
-  public void setTabHTML(int index, String html) {
+  public void setTabHTML(int index, @IsSafeHtml String html) {
     checkIndex(index);
     tabs.get(index).setWidget(new HTML(html));
   }
diff --git a/user/src/com/google/gwt/user/client/ui/TabPanel.java b/user/src/com/google/gwt/user/client/ui/TabPanel.java
index d1a0478..2926ceb 100644
--- a/user/src/com/google/gwt/user/client/ui/TabPanel.java
+++ b/user/src/com/google/gwt/user/client/ui/TabPanel.java
@@ -23,6 +23,8 @@
 import com.google.gwt.event.logical.shared.SelectionEvent;
 import com.google.gwt.event.logical.shared.SelectionHandler;
 import com.google.gwt.event.shared.HandlerRegistration;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 
 import java.util.Iterator;
 
@@ -120,8 +122,8 @@
       return false;
     }
 
-    protected void insertProtected(Widget w, String tabText, boolean asHTML,
-        int beforeIndex) {
+    protected void insertProtected(
+        Widget w, @IsSafeHtml String tabText, boolean asHTML, int beforeIndex) {
 
       // Check to see if the TabPanel already contains the Widget. If so,
       // remove it and see if we need to shift the position to the left.
@@ -160,7 +162,7 @@
    */
   private class UnmodifiableTabBar extends TabBar {
     @Override
-    public void insertTab(String text, boolean asHTML, int beforeIndex) {
+    public void insertTab(@IsSafeHtml String text, boolean asHTML, int beforeIndex) {
       throw new UnsupportedOperationException(
           "Use TabPanel.insert() to alter the TabBar");
     }
@@ -171,7 +173,7 @@
           "Use TabPanel.insert() to alter the TabBar");
     }
 
-    public void insertTabProtected(String text, boolean asHTML, int beforeIndex) {
+    public void insertTabProtected(@IsSafeHtml String text, boolean asHTML, int beforeIndex) {
       super.insertTab(text, asHTML, beforeIndex);
     }
 
@@ -237,7 +239,7 @@
   /**
    * Convenience overload to allow {@link IsWidget} to be used directly.
    */
-  public void add(IsWidget w, String tabText, boolean asHTML) {
+  public void add(IsWidget w, @IsSafeHtml String tabText, boolean asHTML) {
     add(asWidgetOrNull(w), tabText, asHTML);
   }
 
@@ -266,7 +268,7 @@
    * @param tabText the text to be shown on its tab
    * @param asHTML <code>true</code> to treat the specified text as HTML
    */
-  public void add(Widget w, String tabText, boolean asHTML) {
+  public void add(Widget w, @IsSafeHtml String tabText, boolean asHTML) {
     insert(w, tabText, asHTML, getWidgetCount());
   }
 
@@ -364,8 +366,7 @@
   /**
    * Convenience overload to allow {@link IsWidget} to be used directly.
    */
-  public void insert(IsWidget widget, String tabText, boolean asHTML,
-      int beforeIndex) {
+  public void insert(IsWidget widget, @IsSafeHtml String tabText, boolean asHTML, int beforeIndex) {
     insert(asWidgetOrNull(widget), tabText, asHTML, beforeIndex);
   }
 
@@ -385,8 +386,7 @@
    * @param asHTML <code>true</code> to treat the specified text as HTML
    * @param beforeIndex the index before which it will be inserted
    */
-  public void insert(Widget widget, String tabText, boolean asHTML,
-      int beforeIndex) {
+  public void insert(Widget widget, @IsSafeHtml String tabText, boolean asHTML, int beforeIndex) {
     // Delegate updates to the TabBar to our DeckPanel implementation
     deck.insertProtected(widget, tabText, asHTML, beforeIndex);
   }
@@ -399,6 +399,7 @@
    * @param tabText the text to be shown on its tab
    * @param beforeIndex the index before which it will be inserted
    */
+  @SuppressIsSafeHtmlCastCheck
   public void insert(Widget widget, String tabText, int beforeIndex) {
     insert(widget, tabText, false, beforeIndex);
   }
diff --git a/user/src/com/google/gwt/user/client/ui/TreeItem.java b/user/src/com/google/gwt/user/client/ui/TreeItem.java
index 4749aba..2d93044 100644
--- a/user/src/com/google/gwt/user/client/ui/TreeItem.java
+++ b/user/src/com/google/gwt/user/client/ui/TreeItem.java
@@ -23,6 +23,7 @@
 import com.google.gwt.i18n.client.LocaleInfo;
 import com.google.gwt.safehtml.client.HasSafeHtml;
 import com.google.gwt.safehtml.shared.SafeHtml;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 
 import java.util.ArrayList;
@@ -678,7 +679,7 @@
   }
 
   @Override
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     setWidget(null);
     contentElem.setInnerHTML(html);
   }
diff --git a/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImpl.java b/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImpl.java
index 440f9c0..973d903 100644
--- a/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImpl.java
+++ b/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImpl.java
@@ -18,6 +18,7 @@
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.event.logical.shared.HasInitializeHandlers;
 import com.google.gwt.event.logical.shared.InitializeEvent;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.Event;
 import com.google.gwt.user.client.ui.RichTextArea;
@@ -71,7 +72,7 @@
     }
   }-*/;
 
-  public void setHTML(String html) {
+  public void setHTML(@IsSafeHtml String html) {
     elem.setPropertyString("value", html);
   }
 
diff --git a/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplIE8toIE10.java b/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplIE8toIE10.java
index c8afa83..7616002 100644
--- a/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplIE8toIE10.java
+++ b/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplIE8toIE10.java
@@ -17,6 +17,7 @@
 
 import com.google.gwt.dom.client.Element;
 import com.google.gwt.dom.client.Node;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 
 /**
  * IE6-specific implementation of rich-text editing.
@@ -69,7 +70,7 @@
   }-*/;
 
   @Override
-  public native void insertHTML(String html) /*-{
+  public native void insertHTML(@IsSafeHtml String html) /*-{
     try {
       var elem = this.@com.google.gwt.user.client.ui.impl.RichTextAreaImpl::elem;
       var doc = elem.contentWindow.document;
diff --git a/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplStandard.java b/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplStandard.java
index 075a546..09b1267 100644
--- a/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplStandard.java
+++ b/user/src/com/google/gwt/user/client/ui/impl/RichTextAreaImplStandard.java
@@ -17,6 +17,8 @@
 
 import com.google.gwt.core.client.JavaScriptException;
 import com.google.gwt.dom.client.Element;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
+import com.google.gwt.safehtml.shared.annotations.SuppressIsSafeHtmlCastCheck;
 import com.google.gwt.user.client.DOM;
 import com.google.gwt.user.client.ui.RichTextArea;
 import com.google.gwt.user.client.ui.RichTextArea.FontSize;
@@ -111,7 +113,7 @@
     execCommand("InsertHorizontalRule", null);
   }
 
-  public void insertHTML(String html) {
+  public void insertHTML(@IsSafeHtml String html) {
     execCommand("InsertHTML", html);
   }
 
@@ -218,7 +220,7 @@
   }
 
   @Override
-  public final void setHTML(String html) {
+  public final void setHTML(@IsSafeHtml String html) {
     if (beforeInitPlaceholder == null) {
       setHTMLImpl(html);
     } else {
@@ -276,6 +278,7 @@
   }
 
   @Override
+  @SuppressIsSafeHtmlCastCheck
   public void uninitElement() {
     isReady = false;
 
@@ -293,7 +296,7 @@
     // Recreate the placeholder element and store the iframe's contents and the
     // enabled status in it. This is necessary because some browsers will wipe
     // the iframe's contents when it is removed from the DOM.
-    String html = getHTML();
+    @IsSafeHtml String html = getHTML(); // TODO: mXSS
     boolean enabled = isEnabled();
     beforeInitPlaceholder = DOM.createDiv();
     beforeInitPlaceholder.setInnerHTML(html);
@@ -354,7 +357,7 @@
     return elem.contentWindow.document.designMode.toUpperCase() == 'ON';
   }-*/;
 
-  @Override
+  @Override @SuppressIsSafeHtmlCastCheck
   protected void onElementInitialized() {
     // Issue 1897: This method is called after a timeout, during which time the
     // element might by detached.
@@ -398,7 +401,7 @@
     }
   }-*/;
 
-  protected native void setHTMLImpl(String html) /*-{
+  protected native void setHTMLImpl(@IsSafeHtml String html) /*-{
     this.@com.google.gwt.user.client.ui.impl.RichTextAreaImpl::elem.contentWindow.document.body.innerHTML = html;
   }-*/;
 
diff --git a/user/src/com/google/gwt/user/datepicker/client/DefaultMonthSelector.java b/user/src/com/google/gwt/user/datepicker/client/DefaultMonthSelector.java
index 7b9d0e7..a00fe93 100644
--- a/user/src/com/google/gwt/user/datepicker/client/DefaultMonthSelector.java
+++ b/user/src/com/google/gwt/user/datepicker/client/DefaultMonthSelector.java
@@ -21,6 +21,7 @@
 import com.google.gwt.event.dom.client.ChangeHandler;
 import com.google.gwt.event.dom.client.ClickEvent;
 import com.google.gwt.event.dom.client.ClickHandler;
+import com.google.gwt.safehtml.shared.annotations.IsSafeHtml;
 import com.google.gwt.user.client.ui.FlexTable;
 import com.google.gwt.user.client.ui.ListBox;
 import com.google.gwt.user.client.ui.PushButton;
@@ -118,7 +119,8 @@
     initWidget(grid);
   }
 
-  private PushButton createNavigationButton(String label, final int noOfMonths, String styleName) {
+  private PushButton createNavigationButton(
+      @IsSafeHtml String label, final int noOfMonths, String styleName) {
     PushButton button = new PushButton();
 
     button.addClickHandler(new ClickHandler() {