success: false,
		},
		// duplicate 'expiration' reject
		{

        // onerror attribute should be removed
        assertFalse(result.contains("onerror"));
    }

    @Test
    public void test_render_xss_iframeTag() {
        String malicious = "<iframe src=\"http://evil.com\"></iframe>";
        String result = markdownRenderer.render(malicious);
        // iframe tags should be removed
        assertFalse(result.contains("<iframe"));
        assertFalse(result.contains("</iframe>"));

        // Test multiple path traversal sequences
        File baseDir = new File(tempDir.toFile(), "images");
        baseDir.mkdirs();
        File maliciousFile = new File(baseDir, "a/b/c/../../../../../tmp/evil");

        Boolean result = invokeIsValidUploadPath(maliciousFile, baseDir);
        assertFalse("Multiple path traversals should be blocked", result);
    }

    @Test