add unit tests for xss