From fbc548e903f73ffc7b05cc89d67dff1083bfde3e Mon Sep 17 00:00:00 2001
From: Claudio Ortolina <cloud8421@gmail.com>
Date: Thu, 16 Apr 2026 23:14:00 +0100
Subject: [PATCH] Explicitly trust Wikipedia's HTML

Closes #168
---
 lib/music_library_web/live/artist_live/show.ex | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/music_library_web/live/artist_live/show.ex b/lib/music_library_web/live/artist_live/show.ex
index 928c4985..8315b4a8 100644
--- a/lib/music_library_web/live/artist_live/show.ex
+++ b/lib/music_library_web/live/artist_live/show.ex
@@ -295,7 +295,7 @@ defmodule MusicLibraryWeb.ArtistLive.Show do
                 placement="left"
               >
                 <div class="dark:prose-invert prose prose-sm">
-                  {Phoenix.HTML.raw(@biography.bio_html)}
+                  {render_bio(@biography)}
                 </div>
                 <a
                   :if={@biography.url}
@@ -735,4 +735,10 @@ defmodule MusicLibraryWeb.ArtistLive.Show do
       wishlist: Enum.sort_by(wishlist, fn r -> r.release_date end, :desc)
     }
   end
+
+  # Wikipedia returns sanitized HTML, so we can skip sanitization.
+  # sobelow_skip ["XSS.Raw"]
+  defp render_bio(biography) do
+    {Phoenix.HTML.raw(biography.bio_html)}
+  end
 end