String malicious = "[Click me](data:text/html,<script>alert('XSS')</script>)";
        String result = markdownRenderer.render(malicious);
        // data: protocol should be blocked
        assertFalse(result.contains("data:text/html"));
    }

    @Test
    public void test_render_xss_imgOnerror() {
        String malicious = "<img src=\"x\" onerror=\"alert('XSS')\">";

				</div>
			</div>
			<section class="content">
				<la:form action="/admin/sereq/upload/" enctype="multipart/form-data">
					<div class="col-md-12">
						<la:info id="msg" message="true">
							<div class="alert alert-success">${msg}</div>
						</la:info>
						<la:errors />
					</div>
					<div class="col-md-12">
						<div class="card card-outline card-primary">
							<div class="card-header">
								<h3 class="card-title">

                                    <%-- Message --%>
                                <div>
                                    <la:info id="msg" message="true">
                                        <div class="alert alert-success">${msg}</div>
                                    </la:info>
                                    <la:errors/>
                                </div>
                                <div class="form-group row">

                            <div class="card-body">
                                <div>
                                    <la:info id="msg" message="true">
                                        <div class="alert alert-success">${msg}</div>
                                    </la:info>
                                    <la:errors property="_global"/>
                                </div>

				<p class="login-box-msg">
					<la:message key="labels.login.newpassword" />
				</p>
				<%-- Message --%>
				<div>
					<la:info id="msg" message="false">
						<div class="alert alert-info">${msg}</div>
					</la:info>
					<la:errors />
				</div>
				<la:form styleId="newPassword" method="post">
					<div class="input-group mb-3">
						<c:set var="ph_new_password">

			<div class="card-body login-card-body">
				<p class="login-box-msg">
					<la:message key="labels.login" />
				</p>
				<%-- Message --%>
				<div>
					<la:info id="msg" message="false">
						<div class="alert alert-info">${msg}</div>
					</la:info>
					<la:errors />
				</div>
				<la:form styleId="login" method="post">
					<div class="input-group mb-3">
						<c:set var="ph_username">

                                    <%-- Message --%>
                                <div>
                                    <la:info id="msg" message="true">
                                        <div class="alert alert-success">${msg}</div>
                                    </la:info>
                                    <la:errors/>
                                </div>
                                    <%-- Form Fields --%>

    html = get_swagger_ui_html(
        openapi_url="/openapi.json",
        title="Test",
        swagger_ui_parameters={"customKey": "<img src=x onerror=alert(1)>"},
    )
    body = html.body.decode()
    assert "<img src=x onerror=alert(1)>" not in body
    assert "\\u003cimg" in body


def test_normal_init_oauth_still_works():
    html = get_swagger_ui_html(
        openapi_url="/openapi.json",

                                    <%-- Message --%>
                                <div>
                                    <la:info id="msg" message="true">
                                        <div class="alert alert-success">${msg}</div>
                                    </la:info>
                                    <la:errors/>
                                </div>
                                    <%-- Form Fields --%>

                                    <%-- Message --%>
                                <div>
                                    <la:info id="msg" message="true">
                                        <div class="alert alert-success">${msg}</div>
                                    </la:info>
                                    <la:errors/>
                                </div>
                                    <%-- Form Fields --%>