Protection against XSS on markdown rendering