What else adds order comments?

Question

I have a task to add a WYSIWYG editor on the admin order comments.
So far so good. I was able to make it work.
But I have a concern. By default order comments are escaped when listed and only a few tags are allowed on the backend.

echo $this->escapeHtml($_item->getComment(), array('b','br','strong','i','u')); //backend
echo $this->escapeHtml($_historyItem->getComment());  //frontend

Also when sending the e-mail all tags are stripped.

$comment = trim(strip_tags($data['comment']));

I changed that to allow all HTML tags and it seams to work just fine, but who else writes these comments?

What I know so far is:

1. The admins, manually - and I trust them
2. Online payment methods when sending a payment update - and I trust them.

Should I look at something else?

[EDIT]
I realized from the comments below that I may have not made this clear.
Everything seams to work ok, I don't have comments appearing out of nowhere, I'm just concerned if this is a good practice or should I be careful of something else that might post order comments.

Answer 1

If in doubt about 3rd party comments, why not just wrap the method in a conditional statement.

Assuming that only your admin users need access to WYSIWIG/HTML comment support, then you could ensure it is only enabled for such. For API based comments (eg. Payment gateway notifications), then escape the HTML as normal.

I wouldn't trust any 3rd party to have unescaped HTML control over the comments (why expose the risk?).

It seems simple, trust no-one but your admin staff, only permit unescaped comments from those entering them via the admin (not via API).