Check for DOM clobbering attacks in sanitizing/node validation

tools/dom/templates/html/impl/impl_Element.darttemplate

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of $LIBRARYNAME;
 
 class _ChildrenElementList extends ListBase<Element>
     implements NodeListWrapper {
   // Raw Element.
   final Element _element;
@@ skipping 1369 matching lines @@
     append(createFragment(
         html, validator: validator, treeSanitizer: treeSanitizer));
   }
   String get innerHtml => _innerHtml;
 
   /**
    * This is an ease-of-use accessor for event streams which should only be
    * used when an explicit accessor is not available.
    */
   ElementEvents get on => new ElementEvents(this);
+  
+  /**
+   * Verify if any of the attributes that we use in the sanitizer look unexpected,
+   * possibly indicating DOM clobbering attacks.
+   *
+   * Those attributes are: attributes, lastChild, children, previousNode and tagName.
+   */
+$if DART2JS
+  bool get _hasCorruptedAttributes {
+     return JS('bool', r'''
+       (function(element) {
+         if (!(element.attributes instanceof NamedNodeMap)) {
+           return true;
+         }
+         var childNodes = element.childNodes;
+         if (element.lastChild &&
+             element.lastChild !== childNodes[childNodes.length -1]) {
+           return true;
+         }
+         if (element.children) { // On Safari, children can apparently be null.
+           if (!((element.children instanceof HTMLCollection) ||
+               (element.children instanceof NodeList))) {
+             return true;
+           }
+         }
+         return false;
+          })(#)''', this);
+  }
+$else
+  // Dartium isn't affected by these attacks, because it goes directly to the C++ API.
+  bool get _hasCorruptedAttributes => false;
+$endif
 
 $if DART2JS
   @DomName('Element.offsetHeight')
   @DocsEditable()
   int get offsetHeight => JS('num', '#.offsetHeight', this).round();
 
   @DomName('Element.offsetLeft')
   @DocsEditable()
   int get offsetLeft => JS('num', '#.offsetLeft', this).round();
 
@@ skipping 145 matching lines @@
   const ScrollAlignment._internal(this._value);
   toString() => 'ScrollAlignment.$_value';
 
   /// Attempt to align the element to the top of the scrollable area.
   static const TOP = const ScrollAlignment._internal('TOP');
   /// Attempt to center the element in the scrollable area.
   static const CENTER = const ScrollAlignment._internal('CENTER');
   /// Attempt to align the element to the bottom of the scrollable area.
   static const BOTTOM = const ScrollAlignment._internal('BOTTOM');
 }