Audit XSS resistance

[cchan]

Of markdown-it

[cchan]

And see if there's any special things that could be passed in the serialized json? Currently we marshal into a struct, and if that succeeds we just use the original string without remarshaling. Is this bad? What if you unmarshal a string that has extra params beyond those in the struct?