From 4904249025472b8d1e83285edc2e953d5c51173b Mon Sep 17 00:00:00 2001
From: Simon Willison <swillison@gmail.com>
Date: Thu, 3 Sep 2026 14:35:58 -0700
Subject: [PATCH] Use .textContent for column names in column chooser

Refs GHSA-hp2x-vx2r-6vxg

Co-authored-by: Alex Garcia <15178711+asg017@users.noreply.github.com>
---
 datasette/static/column-chooser.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/datasette/static/column-chooser.js b/datasette/static/column-chooser.js
index 198641f3..c3d5796c 100644
--- a/datasette/static/column-chooser.js
+++ b/datasette/static/column-chooser.js
@@ -472,11 +472,13 @@ class ColumnChooser extends HTMLElement {
           <span class="drag-item-check">
             <input type="checkbox" ${this._checked.has(col) ? "checked" : ""}>
           </span>
-          <span class="drag-item-label">${col}</span>
+          <span class="drag-item-label"></span>
         </label>
         <div class="drop-indicator"></div>
       `;
 
+      li.querySelector(".drag-item-label").textContent = col;
+
       li.querySelector("input").addEventListener("change", (e) => {
         e.target.checked ? this._checked.add(col) : this._checked.delete(col);
         this._updateCounts();