diff --git a/core/src/main/resources/hudson/model/Job/buildTimeTrend_resources.js b/core/src/main/resources/hudson/model/Job/buildTimeTrend_resources.js
index 19513361e774..4d78549beab7 100644
--- a/core/src/main/resources/hudson/model/Job/buildTimeTrend_resources.js
+++ b/core/src/main/resources/hudson/model/Job/buildTimeTrend_resources.js
@@ -9,42 +9,56 @@ window.buildTimeTrend_displayBuilds = function (data) {
 
   for (var x = 0; data.length > x; x++) {
     var e = data[x];
-    var tr = new Element("tr");
-    tr.insert(
-      new Element("td", { data: e.iconColorOrdinal }).insert(
-        new Element("a", {
-          class: "build-status-link",
-          href: e.number + "/console",
-        }).insert(generateSVGIcon(e.iconName))
-      )
-    );
-    tr.insert(
-      new Element("td", { data: e.number }).insert(
-        new Element("a", {
-          href: e.number + "/",
-          class: "model-link inside",
-        }).update(e.displayName.escapeHTML())
-      )
-    );
-    tr.insert(
-      new Element("td", { data: e.duration }).update(
-        e.durationString.escapeHTML()
-      )
-    );
+    var tr = document.createElement("tr");
+
+    let td = document.createElement("td");
+    td.setAttribute("data", e.iconColorOrdinal);
+
+    let link = document.createElement("a");
+    link.classList.add("build-status-link");
+    link.href = e.number + "/console";
+    td.appendChild(link);
+    let svg = generateSVGIcon(e.iconName);
+    link.appendChild(svg);
+    tr.appendChild(td);
+
+    td = document.createElement("td");
+    td.setAttribute("data", e.number);
+
+    link = document.createElement("a");
+    link.href = e.number + "/";
+    link.classList.add("model-link", "inside");
+    link.innerText = escapeHTML(e.displayName);
+
+    td.appendChild(link);
+    tr.appendChild(td);
+
+    td = document.createElement("td");
+    td.setAttribute("data", e.duration);
+
+    td.innerText = escapeHTML(e.durationString);
+
+    tr.appendChild(td);
     if (isDistributedBuildsEnabled) {
       var buildInfo = null;
-      var buildInfoStr = (e.builtOnStr || "").escapeHTML();
+      var buildInfoStr = escapeHTML(e.builtOnStr || "");
       if (e.builtOn) {
-        buildInfo = new Element("a", {
-          href: rootURL + "/computer/" + e.builtOn,
-          class: "model-link inside",
-        }).update(buildInfoStr);
+        buildInfo = document.createElement("a");
+        buildInfo.href = rootURL + "/computer/" + e.builtOn;
+        buildInfo.classList.add("model-link", "inside");
+        buildInfo.innerText = buildInfoStr;
       } else {
         buildInfo = buildInfoStr;
       }
-      tr.insert(new Element("td").update(buildInfo));
+      td = document.createElement("td");
+      if (buildInfo instanceof Node) {
+        td.appendChild(buildInfo);
+      } else {
+        td.innerText = buildInfo;
+      }
+      tr.appendChild(td);
     }
-    p.insert(tr);
+    p.appendChild(tr);
     Behaviour.applySubtree(tr);
   }
   ts_refresh(p);
@@ -112,13 +126,15 @@ function generateSVGIcon(iconName, iconSizeClass) {
   );
   svg2.appendChild(use2);
 
-  const span = new Element("span", {
-    class: "build-status-icon__wrapper icon-" + iconName,
-  })
-    .insert(
-      new Element("span", { class: "build-status-icon__outer" }).insert(svg1)
-    )
-    .insert(svg2);
+  const span = document.createElement("span");
+  span.classList.add("build-status-icon__wrapper", "icon-" + iconName);
+
+  let span2 = document.createElement("span");
+  span2.classList.add("build-status-icon__outer");
+  span2.appendChild(svg1);
+
+  span.appendChild(span2);
+  span.appendChild(svg2);
 
   return span;
 }
diff --git a/core/src/main/resources/lib/form/hetero-list/hetero-list.js b/core/src/main/resources/lib/form/hetero-list/hetero-list.js
index 5f58e7ad5232..7f4df9bd1640 100644
--- a/core/src/main/resources/lib/form/hetero-list/hetero-list.js
+++ b/core/src/main/resources/lib/form/hetero-list/hetero-list.js
@@ -37,10 +37,7 @@ Behaviour.specify(
       // YUI Menu interprets this <option> text node as HTML, so let's escape it again!
       var title = n.getAttribute("title");
       if (title) {
-        title = title
-          .replace(/&/g, "&amp;")
-          .replace(/</g, "&lt;")
-          .replace(/>/g, "&gt;");
+        title = escapeHTML(title);
       }
       menu.options[i] = new Option(title, "" + i);
       templates.push({
diff --git a/war/.eslintrc.js b/war/.eslintrc.js
index a58fe63eccf6..cb93245fb38f 100644
--- a/war/.eslintrc.js
+++ b/war/.eslintrc.js
@@ -30,6 +30,7 @@ module.exports = {
     createSearchBox: "readonly",
     crumb: "readonly",
     ensureVisible: "readonly",
+    escapeHTML: "readonly",
     findAncestor: "readonly",
     findAncestorClass: "readonly",
     findElementsBySelector: "readonly",
diff --git a/war/src/main/webapp/scripts/hudson-behavior.js b/war/src/main/webapp/scripts/hudson-behavior.js
index 044e5720373f..eb42f1d844a3 100644
--- a/war/src/main/webapp/scripts/hudson-behavior.js
+++ b/war/src/main/webapp/scripts/hudson-behavior.js
@@ -837,6 +837,13 @@ function preventInputEe(event) {
   }
 }
 
+function escapeHTML(html) {
+  return html
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
 /**
  * Wraps a <button> into YUI button.
  *
@@ -857,10 +864,7 @@ function makeButton(e, onclick) {
   // similar to how the child nodes of a <button> are treated as HTML.
   // in standard HTML, we wouldn't expect the former case, yet here we are!
   if (e.tagName === "INPUT") {
-    attributes.label = e.value
-      .replace(/&/g, "&amp;")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;");
+    attributes.label = escapeHTML(e.value);
   }
   var btn = new YAHOO.widget.Button(e, attributes);
   if (onclick != null) btn.addListener("click", onclick);
@@ -2241,10 +2245,7 @@ function createSearchBox(searchURL) {
 
   // update positions and sizes of the components relevant to search
   function updatePos() {
-    sizer.innerHTML = box.value
-      .replace(/&/g, "&amp;")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;");
+    sizer.innerHTML = escapeHTML(box.value);
     var cssWidth,
       offsetWidth = sizer.offsetWidth;
     if (offsetWidth > 0) {