}

    @Test
    public void test_render_xss_onclickAttribute() {
        String malicious = "<a href=\"#\" onclick=\"alert('XSS')\">Click</a>";
        String result = markdownRenderer.render(malicious);
        // onclick attribute should be removed
        assertFalse(result.contains("onclick"));
    }

    @Test
    public void test_render_xss_javascriptProtocol() {

                    document.body.appendChild(downloadLink);

                    downloadLink.click();
                }
            </script>
            <a class="btn btn-info" role="button" onclick="acceptAllErrorCorrections()">Accept Changes for all Errors</a>
        """
    }

    private static String buildAutoSelectSeverityFilter() {
        // language=javascript
        return """