Import issue history in backlog.md

2026-04-20 10:01:47 +01:00
parent 78487b0085
commit f995e01ca7
146 changed files with 4901 additions and 0 deletions
@@ -0,0 +1,48 @@
+---
+id: ML-15
+title: Sanitize Wikipedia bio_html in ArtistLive.Show
+status: Done
+assignee: []
+created_date: '2026-04-20 08:50'
+labels: []
+dependencies: []
+references:
+  - 'https://github.com/cloud8421/music_library/issues/168'
+priority: medium
+---
+
+## Description
+
+<!-- SECTION:DESCRIPTION:BEGIN -->
+_GitHub: created 2026-04-16 · updated 2026-04-16 · closed 2026-04-16_
+
+## Summary
+
+`lib/music_library_web/live/artist_live/show.ex:298` renders Wikipedia-sourced HTML via `Phoenix.HTML.raw(@biography.bio_html)` without sanitization or a `# sobelow_skip` annotation — inconsistent with the rest of the codebase.
+
+## Evidence
+
+- `bio_html` is produced in `lib/music_library_web/live/artist_live/biography.ex:13` from `ArtistInfo.wikipedia_bio/1`, reading `wikipedia_data["intro_html"]`
+- Populated verbatim from Wikipedia's REST API in `lib/wikipedia.ex:14-15` — no sanitization before storage or rendering.
+- Every other `raw()` site in the codebase either routes through `Markdown.to_html/1` (MDEx + ammonia) or carries a justified `# sobelow_skip ["XSS.Raw"]` comment (7 such sites verified).
+- `biography.ex:76` already sanitizes the Last.fm bio path via `Markdown.to_html/1` — only the Wikipedia path is inconsistent.
+
+## Risk
+
+Low under the single-user threat model (Wikipedia's REST API returns sanitized HTML). Worth fixing for consistency so future reviewers don't have to re-derive the trust decision.
+
+## Fix
+
+Either:
+1. Pipe `bio_html` through `MDEx.safe_html/2` with `MDEx.Document.default_sanitize_options()` (strongest), or
+2. Add `# sobelow_skip ["XSS.Raw"]` at `show.ex:298` with a comment explaining Wikipedia is a trusted third-party HTML source (consistent with the other 7 annotation sites).
+
+## Acceptance Criteria
+<!-- AC:BEGIN -->
+- Either HTML sanitization applied, or annotation + justification added
+- Sobelow scan stays clean at `--exit high`
+<!-- SECTION:DESCRIPTION:END -->
+
+- [ ] #1 Either HTML sanitization applied, or annotation + justification added
+- [ ] #2 Sobelow scan stays clean at `--exit high`
+<!-- AC:END -->