src/vs/base/browser/markdownRenderer.ts/getInsaneOptions
function getInsaneOptions(options: { readonly isTrusted?: boolean }): InsaneOptions {
	const allowedSchemes = [
		Schemas.http,
		Schemas.https,
		Schemas.mailto,
		Schemas.data,
		Schemas.file,
		Schemas.vscodeRemote,
		Schemas.vscodeRemoteResource,
	];

	if (options.isTrusted) {
		allowedSchemes.push(Schemas.command);
	}

	return {
		allowedSchemes,
		// allowedTags should included everything that markdown renders to.
		// Since we have our own sanitize function for marked, it's possible we missed some tag so let insane make sure.
		// HTML tags that can result from markdown are from reading https://spec.commonmark.org/0.29/
		// HTML table tags that can result from markdown are from https://github.github.com/gfm/#tables-extension-
		allowedTags: ['ul', 'li', 'p', 'code', 'blockquote', 'ol', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'em', 'pre', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'div', 'del', 'a', 'strong', 'br', 'img', 'span'],
		allowedAttributes: {
			'a': ['href', 'name', 'target', 'data-href'],
			'img': ['src', 'title', 'alt', 'width', 'height'],
			'div': ['class', 'data-code'],
			'span': ['class', 'style'],
			// https://github.com/microsoft/vscode/issues/95937
			'th': ['align'],
			'td': ['align']
		},
		filter(token: { tag: string; attrs: { readonly [key: string]: string; }; }): boolean {
			if (token.tag === 'span' && options.isTrusted) {
				if (token.attrs['style'] && (Object.keys(token.attrs).length === 1)) {
					return !!token.attrs['style'].match(/^(color\:#[0-9a-fA-F]+;)?(background-color\:#[0-9a-fA-F]+;)?$/);
				} else if (token.attrs['class']) {
					// The class should match codicon rendering in src\vs\base\common\codicons.ts
					return !!token.attrs['class'].match(/^codicon codicon-[a-z\-]+( codicon-modifier-[a-z\-]+)?$/);
				}
				return false;
			}
			return true;
		}
	};
}