From 1f059f4b35faf37a79d87b3e1f7ceb9018eff4d0 Mon Sep 17 00:00:00 2001
From: Laura Sach <5183697+lawsie@users.noreply.github.com>
Date: Thu, 16 Jul 2026 10:43:33 +0100
Subject: [PATCH] Guard against injection

---
 main/blocklyinit.js | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/main/blocklyinit.js b/main/blocklyinit.js
index 8f806a67..36e4be98 100644
--- a/main/blocklyinit.js
+++ b/main/blocklyinit.js
@@ -35,7 +35,6 @@ import { defineSensingBlocks } from '../blocks/sensing.js';
 import { defineTextBlocks } from '../blocks/text.js';
 import { defineGenerators } from '../generators/generators.js';
 import { registerCustomCommentIcon } from './customCommentIcon.js';
-import { getMeshFromBlock } from '../ui/blockmesh.js';
 import { initContextMenus } from '../ui/contextmenu.js';
 import {
   applyBlockLockState,
@@ -919,8 +918,19 @@ export function initializeWorkspace() {
         const item = document.createElement('button');
         item.type = 'button';
         item.className = 'mobile-search-result-item';
-        const pillStyle = color ? ` style="background-color:${color}"` : '';
-        item.innerHTML = `<span class="mobile-search-result-name">${label}</span>${category ? `<span class="mobile-search-result-category"${pillStyle}>${category}</span>` : ''}`;
+
+        const nameSpan = document.createElement('span');
+        nameSpan.className = 'mobile-search-result-name';
+        nameSpan.textContent = label;
+        item.appendChild(nameSpan);
+
+        if (category) {
+          const categorySpan = document.createElement('span');
+          categorySpan.className = 'mobile-search-result-category';
+          if (color) categorySpan.style.backgroundColor = color;
+          categorySpan.textContent = category;
+          item.appendChild(categorySpan);
+        }
 
         item.addEventListener('click', () => {
           if (overlay.isConnected) {