Use .textContent for column names in column chooser

Refs GHSA-hp2x-vx2r-6vxg

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
This commit is contained in:
Simon Willison 2026-09-03 14:35:58 -07:00
commit 4904249025

View file

@ -472,11 +472,13 @@ class ColumnChooser extends HTMLElement {
<span class="drag-item-check">
<input type="checkbox" ${this._checked.has(col) ? "checked" : ""}>
</span>
<span class="drag-item-label">${col}</span>
<span class="drag-item-label"></span>
</label>
<div class="drop-indicator"></div>
`;
li.querySelector(".drag-item-label").textContent = col;
li.querySelector("input").addEventListener("change", (e) => {
e.target.checked ? this._checked.add(col) : this._checked.delete(col);
this._updateCounts();