music_library/backlog/completed/ml-15 - Sanitize-Wikipedia-bio_html-in-ArtistLive.Show.md

id, title, status, assignee, created_date, labels, dependencies, references, priority

id	title	status	assignee	created_date	labels	dependencies	references	priority
ML-15	Sanitize Wikipedia bio_html in ArtistLive.Show	Done		2026-04-20 08:50			https://github.com/cloud8421/music_library/issues/168	medium

Description

GitHub: created 2026-04-16 · updated 2026-04-16 · closed 2026-04-16

Summary

lib/music_library_web/live/artist_live/show.ex:298 renders Wikipedia-sourced HTML via Phoenix.HTML.raw(@biography.bio_html) without sanitization or a # sobelow_skip annotation — inconsistent with the rest of the codebase.

Evidence

• bio_html is produced in lib/music_library_web/live/artist_live/biography.ex:13 from ArtistInfo.wikipedia_bio/1, reading wikipedia_data["intro_html"]
• Populated verbatim from Wikipedia's REST API in lib/wikipedia.ex:14-15 — no sanitization before storage or rendering.
• Every other raw() site in the codebase either routes through Markdown.to_html/1 (MDEx + ammonia) or carries a justified # sobelow_skip ["XSS.Raw"] comment (7 such sites verified).
• biography.ex:76 already sanitizes the Last.fm bio path via Markdown.to_html/1 — only the Wikipedia path is inconsistent.

Risk

Low under the single-user threat model (Wikipedia's REST API returns sanitized HTML). Worth fixing for consistency so future reviewers don't have to re-derive the trust decision.

Fix

Either:

1. Pipe bio_html through MDEx.safe_html/2 with MDEx.Document.default_sanitize_options() (strongest), or
2. Add # sobelow_skip ["XSS.Raw"] at show.ex:298 with a comment explaining Wikipedia is a trusted third-party HTML source (consistent with the other 7 annotation sites).

Acceptance Criteria

• Either HTML sanitization applied, or annotation + justification added
• Sobelow scan stays clean at --exit high

• #1 Either HTML sanitization applied, or annotation + justification added
• #2 Sobelow scan stays clean at --exit high