Claudio Ortolina
795 B
795 B
id, title, status, assignee, created_date, labels, dependencies, references, priority
| id | title | status | assignee | created_date | labels | dependencies | references | priority | |
|---|---|---|---|---|---|---|---|---|---|
| ML-73 | Sanitize markdown HTML output in search and record set components | Done | 2026-04-20 08:56 |
|
low |
Description
GitHub: created 2026-03-07 · updated 2026-03-07 · closed 2026-03-07
The following locations render markdown descriptions via Markdown.to_html() + raw() without HTML sanitization:
lib/music_library_web/components/search_components.ex:353lib/music_library_web/live/record_set_live/index.ex:472lib/music_library_web/live/record_set_live/show.ex:308
Same pattern as the Notes component. Should sanitize for defense in depth.