String result = markdownRenderer.render(malicious);
        // data: protocol should be blocked
        assertFalse(result.contains("data:text/html"));
    }

    @Test
    public void test_render_xss_imgOnerror() {
        String malicious = "<img src=\"x\" onerror=\"alert('XSS')\">";
        String result = markdownRenderer.render(malicious);
        // onerror attribute should be removed