fix markdown xss test