music_library/backlog/completed/ml-73 - Sanitize-markdown-HTML-output-in-search-and-record-set-components.md

id, title, status, assignee, created_date, labels, dependencies, references, priority

id	title	status	assignee	created_date	labels	dependencies	references	priority
ML-73	Sanitize markdown HTML output in search and record set components	Done		2026-04-20 08:56			https://github.com/cloud8421/music_library/issues/102	low

Description

GitHub: created 2026-03-07 · updated 2026-03-07 · closed 2026-03-07

The following locations render markdown descriptions via Markdown.to_html() + raw() without HTML sanitization:

• lib/music_library_web/components/search_components.ex:353
• lib/music_library_web/live/record_set_live/index.ex:472
• lib/music_library_web/live/record_set_live/show.ex:308

Same pattern as the Notes component. Should sanitize for defense in depth.