String malicious = "<a href=\"#\" onclick=\"alert('XSS')\">Click</a>";
        String result = markdownRenderer.render(malicious);
        // onclick attribute should be removed
        assertFalse(result.contains("onclick"));
    }

    @Test
    public void test_render_xss_javascriptProtocol() {
        String malicious = "[Click me](javascript:alert('XSS'))";
        String result = markdownRenderer.render(malicious);

HTTP/1.1 503 Service Unavailable
Accept-Ranges: bytes
Content-Length: 0
Server: MinIO
Vary: Origin
X-Amz-Bucket-Region: us-east-1
X-Minio-Write-Quorum: 3
X-Amz-Request-Id: 16239D6AB80EBECF
X-Xss-Protection: 1; mode=block
Date: Tue, 21 Jul 2020 00:36:14 GMT
```

### Cluster-readable probe

The reply is '200 OK' if cluster has read quorum if not it returns '503 Service Unavailable'.

```

import org.owasp.html.HtmlPolicyBuilder;
import org.owasp.html.PolicyFactory;

/**
 * Renders markdown to sanitized HTML for safe display in the chat interface.
 * Uses commonmark for markdown parsing and OWASP HTML Sanitizer for XSS prevention.
 */
public class MarkdownRenderer {

    private static final Logger logger = LogManager.getLogger(MarkdownRenderer.class);

    private Parser markdownParser;
    private HtmlRenderer htmlRenderer;

    ImmutableSet<String> uppercaseAcronyms =
        ImmutableSet.of(
            "CDN", "CH", "ID", "DNT", "DNS", "DPR", "ECT", "GPC", "HTTP2", "IP", "MD5", "P3P",
            "RTT", "TE", "UA", "UID", "URL", "WWW", "XSS");

    for (Field field : httpHeadersFields()) {
      assertThat(field.get(null))
          .isEqualTo(upperToHttpHeaderName(field.getName(), specialCases, uppercaseAcronyms));
    }
  }

            }
            $item.css("background-color", bgColor);
          }
        }
      },

      /**
       * Helper function to safely escape HTML to prevent XSS
       */
      escapeHtml = function (text) {
        return $("<div>").text(text).html();
      },

      suggestor = {
        /**
         * Initialize the suggestor plugin
         */

    "Vary": "Origin,Accept-Encoding",
    "X-Amz-Id-2": "dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8",
    "X-Amz-Request-Id": "17CDC1F4D7E69123",
    "X-Content-Type-Options": "nosniff",
    "X-Xss-Protection": "1; mode=block"
  },
  "tags": {
    "objectLocation": {
      "name": "hosts",
      "poolId": 1,
      "setId": 1,
      "drives": [
        "/mnt/data1",
        "/mnt/data2",

	commonInitialismsReplacer *strings.Replacer
)

func init() {
	commonInitialismsForReplacer := make([]string, 0, len(commonInitialisms))
	for _, initialism := range commonInitialisms {

func addCustomHeadersMiddleware(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		header := w.Header()
		header.Set("X-XSS-Protection", "1; mode=block")                                // Prevents against XSS attacks
		header.Set("X-Content-Type-Options", "nosniff")                                // Prevent mime-sniff

    }

    @Test
    public void test_escapeHtml_scriptTag() {
        assertEquals("&lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;", chatClient.testEscapeHtml("<script>alert('xss')</script>"));
    }

    // ========== buildGoUrl tests ==========

    @Test
    public void test_buildGoUrl_basic() {

        source.put("title", "Title with <script>alert('xss')</script>");
        source.put("content", "Content with & < > \" '");
        source.put("lang", "en");

        final String html = new HtmlIndexExportFormatter().format(source, Collections.emptySet());

        assertTrue(html.contains("<title>Title with &lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;</title>"));