Just search for format_text() and clean_text() in mod/wiki/*, you will get hits only in diff and upgrade, nowhere else!
So I just disabled JS and added new page content with applet tag and it was renderer on the wiki page
The comments use entity decoding but now cleaning if I read the code right, I was not able to test it because there were some fatal errors throws from the wiki comments functions.

The rules are very simple: each student submitted text must be neutralised by format_text(), clean_text() or s()/p() right before outputting to page.