This line should probably be `label = document.createTextNode(column.get("label"))` for security reasons. @bruno-c can you fix this line and merge the PR please?