xss vector for markdown