missing check_plain() call in content_field_overview_form()

When using cck with the organic groups module and upon navigating to admin/content/node-type/group-thread/fields , I get an HTML page with the following invalid HTML:

            <tr class="even draggable menu-disabled tabledrag-leaf tabledrag-root">
                <td>
                        <span class="label-extra">Groups</span>

          </td>
          <td><div class="form-item" id="edit-og-nodeapi-weight-wrapper">
 <input type="text" maxlength="128" name="og_nodeapi[weight]" id="edit-og-nodeapi-weight" size="3" value="0" class="form-text field-weight" />
</div>
<input type="hidden" name="og_nodeapi[parent]" id="edit-og-nodeapi-parent" value=""  class="group-parent" />
<input type="hidden" name="og_nodeapi[hidden_name]" id="edit-og-nodeapi-hidden-name" value="og_nodeapi"  class="field-name" />
</td>
          <td colspan="2">OG audience & Public checkbox.</td>
          <td>&nbsp;&nbsp;</td>
                </tr>

The ampersand is not just allowed to show up anywhere in HTML. I fixed this by wrapping the use of the 'description' field in check_plain in content_field_overview_form(). See attached patch.

The FAPI ['#value'] field may only be assigned valid HTML and the 'description' field does not appear to be intended to hold HTML. If the 'description' field is intended to be valid HTML, please move this bug to the organic groups module so that it can be fixed in the right place.

As a side question, where can I find proper documentation on hook_content_extra_fields()? If such documentation doesn't exist, I'll open another bug for it.