Run comments through formatComment

This prevents possible nastiness, like XSS.

Bug: 54531
Change-Id: I1851f72a475f277ca96cd0117fba11125145e3c5