When doing markdown to HTML, sanitize HTML

Closes #101
Closes #102

lib/music_library_web/components/notes.ex

@@ -156,6 +156,8 @@ defmodule MusicLibraryWeb.Components.Notes do
     end
   end
 
+  # sobelow_skip ["XSS.Raw"]
+  # Markdown.to_html/1 sanitizes HTML via HtmlSanitizeEx
   defp render_content(content) do
     content
     |> Markdown.to_html()

lib/music_library_web/components/search_components.ex

@@ -346,6 +346,8 @@ defmodule MusicLibraryWeb.SearchComponents do
     """
   end
 
+  # sobelow_skip ["XSS.Raw"]
+  # Markdown.to_html/1 sanitizes HTML via HtmlSanitizeEx
   defp render_description(description) do
     description
     |> String.slice(0, 100)

lib/music_library_web/live/record_set_live/index.ex

@@ -466,6 +466,8 @@ defmodule MusicLibraryWeb.RecordSetLive.Index do
     """
   end
 
+  # sobelow_skip ["XSS.Raw"]
+  # Markdown.to_html/1 sanitizes HTML via HtmlSanitizeEx
   defp render_description(description) do
     description
     |> Markdown.to_html()

lib/music_library_web/live/record_set_live/show.ex

@@ -302,6 +302,8 @@ defmodule MusicLibraryWeb.RecordSetLive.Show do
   defp page_title(:edit, record_set), do: gettext("Edit") <> " · " <> record_set.name
   defp page_title(:add_record, record_set), do: gettext("Add Record") <> " · " <> record_set.name
 
+  # sobelow_skip ["XSS.Raw"]
+  # Markdown.to_html/1 sanitizes HTML via HtmlSanitizeEx
   defp render_description(description) do
     description
     |> Markdown.to_html()

lib/music_library_web/markdown.ex

@@ -22,6 +22,7 @@ defmodule MusicLibraryWeb.Markdown do
           markdown_text
           |> process_double_bracket_links()
           |> Earmark.as_html!(%Earmark.Options{gfm: true})
+          |> HtmlSanitizeEx.markdown_html()
 
         {result, %{}}
       end