ZF-8743: StripTags filter should never allow comments

Description

Currently, the StripTags filter allows optionally allowing comments. However, this should never be allowed, as it's possible to perform IE-style conditional comments that could open XSS attack vectors:


$filter = new Zend_Filter_StripTags;                                                                          
$filter->setCommentsAllowed(true);                                                                            
$html = "";                                       
$out = $filter->filter($html);
// results in:
//  

Comments

Resolved in trunk and 1.9, 1.8, and 1.7 release branches.