Severity: P2 (semantic mismatch) · Tier-2 (behavior change; Pascal review)
Co-maintained repo (Pascal = architect).
Location: packages/live_ui/lib/live_ui/widgets/markdown_viewer.ex:25
The widget emits <pre><%= @source %></pre>. Phoenix escapes @source (so no XSS), but the widget named "markdown viewer" never parses markdown — it shows escaped raw text in a <pre>.
Fix: parse + sanitize (Earmark + HtmlSanitizeEx.markdown_html), or rename to reflect raw-source behavior.
2026-05-28 cross-repo review — see ariston-ui docs/audits/cross-repo-review-2026-05-28.md (finding C3).
Severity: P2 (semantic mismatch) · Tier-2 (behavior change; Pascal review)
Co-maintained repo (Pascal = architect).
Location:
packages/live_ui/lib/live_ui/widgets/markdown_viewer.ex:25The widget emits
<pre><%= @source %></pre>. Phoenix escapes@source(so no XSS), but the widget named "markdown viewer" never parses markdown — it shows escaped raw text in a<pre>.Fix: parse + sanitize (Earmark +
HtmlSanitizeEx.markdown_html), or rename to reflect raw-source behavior.2026-05-28 cross-repo review — see ariston-ui
docs/audits/cross-repo-review-2026-05-28.md(finding C3).