bryanwills · pull · Jun 20, 2026 · Jun 20, 2026 · Jun 20, 2026 · Jun 20, 2026
diff --git a/bookmarks/services/exporter.py b/bookmarks/services/exporter.py
@@ -35,7 +35,7 @@ def append_bookmark(doc: BookmarkDocument, bookmark: Bookmark):
     tag_names = bookmark.tag_names
     if bookmark.is_archived:
         tag_names.append("linkding:bookmarks.archived")
-    tags = ",".join(tag_names)
+    tags = ",".join(html.escape(tag) for tag in tag_names)
     toread = "1" if bookmark.unread else "0"
     private = "0" if bookmark.shared else "1"
     added = int(bookmark.date_added.timestamp())

diff --git a/bookmarks/tests/test_bookmark_asset_view.py b/bookmarks/tests/test_bookmark_asset_view.py
@@ -153,6 +153,13 @@ def test_snapshot_download_headers(self):
         )
         self.assertEqual(response["Content-Security-Policy"], "sandbox allow-scripts")
 
+    def test_reader_view_headers(self):
+        bookmark = self.setup_bookmark()
+        asset = self.setup_asset_with_file(bookmark)
+        response = self.client.get(reverse("linkding:assets.read", args=[asset.id]))
+
+        self.assertEqual(response["Content-Security-Policy"], "sandbox allow-scripts")
+
     def test_uploaded_file_download_headers(self):
         bookmark = self.setup_bookmark()
         asset = self.setup_asset_with_uploaded_file(bookmark)

diff --git a/bookmarks/tests/test_exporter.py b/bookmarks/tests/test_exporter.py
@@ -96,6 +96,7 @@ def test_escape_html(self):
             title="<style>: The Style Information element",
             description="The <style> HTML element contains style information for a document, or part of a document.",
             notes="Interesting notes about the <style> HTML element.",
+            tags=[self.setup_tag(name='"'), self.setup_tag(name="&")],
         )
         html = exporter.export_netscape_html([bookmark])
 
@@ -105,6 +106,7 @@ def test_escape_html(self):
             html,
         )
         self.assertIn("Interesting notes about the &lt;style&gt; HTML element.", html)
+        self.assertIn('TAGS="&quot;,&amp;"', html)
 
     def test_handle_empty_values(self):
         bookmark = self.setup_bookmark()

diff --git a/bookmarks/tests/test_settings_general_view.py b/bookmarks/tests/test_settings_general_view.py
@@ -436,18 +436,26 @@ def test_automatic_html_snapshots_should_be_visible_when_snapshots_supported(
         )
 
     def test_about_shows_version_info(self):
-        response = self.client.get(reverse("linkding:settings.general"))
-        html = response.content.decode()
-
-        self.assertInHTML(
-            f"""
-            <tr>
-                <td>Version</td>
-                <td>{get_version_info(random.random())}</td>
-            </tr>
-        """,
-            html,
+        latest_version_response_mock = Mock(
+            status_code=200, json=lambda: {"name": f"v{app_version}"}
         )
+        with patch.object(requests, "get", return_value=latest_version_response_mock):
+            # Clear the lru_cache so the view recomputes the version info under
+            # the mock instead of returning a value cached by an earlier test
+            # that made a real (potentially rate-limited) network call.
+            get_version_info.cache_clear()
+            response = self.client.get(reverse("linkding:settings.general"))
+            html = response.content.decode()
+
+            self.assertInHTML(
+                f"""
+                <tr>
+                    <td>Version</td>
+                    <td>{get_version_info(random.random())}</td>
+                </tr>
+            """,
+                html,
+            )
 
     def test_get_version_info_just_displays_latest_when_versions_are_equal(self):
         latest_version_response_mock = Mock(

diff --git a/bookmarks/views/assets.py b/bookmarks/views/assets.py
@@ -47,10 +47,12 @@ def read(request, asset_id: int):
     content = _get_asset_content(asset)
     content = content.decode("utf-8")
 
-    return render(
+    response = render(
         request,
         "bookmarks/read.html",
         {
             "content": content,
         },
     )
+    response["Content-Security-Policy"] = "sandbox allow-scripts"
+    return response