Markdown xss sanitization