String result = markdownRenderer.render(malicious);
        // onclick attribute should be removed
        assertFalse(result.contains("onclick"));
    }

    @Test
    public void test_render_xss_javascriptProtocol() {
        String malicious = "[Click me](javascript:alert('XSS'))";
        String result = markdownRenderer.render(malicious);
        // javascript: protocol should be blocked