Explicitly trust Wikipedia's HTML

Closes #168
2026-04-16 23:14:00 +01:00
parent 464e627a63
commit fbc548e903
1 changed files with 7 additions and 1 deletions
@@ -295,7 +295,7 @@ defmodule MusicLibraryWeb.ArtistLive.Show do
                placement="left"
              >
                <div class="dark:prose-invert prose prose-sm">
-                  {Phoenix.HTML.raw(@biography.bio_html)}
+                  {render_bio(@biography)}
                </div>
                <a
                  :if={@biography.url}
@@ -735,4 +735,10 @@ defmodule MusicLibraryWeb.ArtistLive.Show do
      wishlist: Enum.sort_by(wishlist, fn r -> r.release_date end, :desc)
    }
  end
+
+  # Wikipedia returns sanitized HTML, so we can skip sanitization.
+  # sobelow_skip ["XSS.Raw"]
+  defp render_bio(biography) do
+    {Phoenix.HTML.raw(biography.bio_html)}
+  end
 end