Function push_column_name 

pub fn push_column_name(out: &mut String, name: &str)

A column’s name as the identifier half of its class.

Why this is not escaping

The name is the one app-supplied string this crate puts in a class attribute rather than in text or an aria-label, so it may never go in raw. A column named a" onclick="steal() emitted

<div class="cell col-a" onclick="steal() cell-fill cell-keeps">

which is a live event handler on every cell of that column. HTML escaping is the reflex and it is the wrong tool here, because a class is read twice: once by the HTML parser, which would decode " back to a quote, and once by the CSS selector an app writes against it. An escaped name is safe in the attribute and unmatchable from the stylesheet, so the two halves would stop meeting – silently, the way every other defect this module’s comments record did.

Reducing the name to identifier characters answers both. What comes out is a valid CSS identifier, so the selector matches, and it holds none of the five characters an attribute value can be ended with, so there is nothing to escape.

What it changes for a name that was already fine

Nothing. Alphanumerics, _ and - pass through, and every column name in the tree is made of those. A name that is not was already broken rather than merely unsafe: Due date emitted col-Due date, which the HTML parser reads as the two classes col-Due and date, and which a selector wrote as a descendant selector that matched neither. Both now agree on col-Due-date.

Alphanumeric in the Unicode sense, not the ASCII one. CSS identifiers admit everything from U+00A0 up, so a column named Größe keeps its name; folding it to Gr--e would collide with a neighbouring column for nothing.