music_library/backlog/completed/ml-74 - Sanitize-markdown-HTML-output-in-Notes-component.md

id, title, status, assignee, created_date, labels, dependencies, references, priority

id	title	status	assignee	created_date	labels	dependencies	references	priority
ML-74	Sanitize markdown HTML output in Notes component	Done		2026-04-20 08:56			https://github.com/cloud8421/music_library/issues/101	low

Description

GitHub: created 2026-03-07 · updated 2026-03-07 · closed 2026-03-07

lib/music_library_web/components/notes.ex:162 renders user-authored markdown via Earmark.as_html!/2 + raw() without HTML sanitization.

Currently single-user so self-XSS only, but should sanitize for defense in depth.