Sanitization should reject elements that we can't examine (e.g. embed/object on FF)

tools/dom/templates/html/impl/impl_Element.darttemplate

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of $LIBRARYNAME;
 
 class _ChildrenElementList extends ListBase<Element>
     implements NodeListWrapper {
   // Raw Element.
   final Element _element;
@@ skipping 1374 matching lines @@
    */
   ElementEvents get on => new ElementEvents(this);
   
   /**
    * Verify if any of the attributes that we use in the sanitizer look unexpected,
    * possibly indicating DOM clobbering attacks.
    *
    * Those attributes are: attributes, lastChild, children, previousNode and tagName.
    */
 $if DART2JS
-  bool get _hasCorruptedAttributes {
+  static bool _hasCorruptedAttributes(Element element) {
      return JS('bool', r'''
        (function(element) {
          if (!(element.attributes instanceof NamedNodeMap)) {
            return true;
          }
          var childNodes = element.childNodes;
          if (element.lastChild &&
              element.lastChild !== childNodes[childNodes.length -1]) {
            return true;
          }
          if (element.children) { // On Safari, children can apparently be null.
            if (!((element.children instanceof HTMLCollection) ||
                (element.children instanceof NodeList))) {
              return true;
            }
          }
          return false;
-          })(#)''', this);
+          })(#)''', element);
   }
 $else
   // Dartium isn't affected by these attacks, because it goes directly to the C++ API.
-  bool get _hasCorruptedAttributes => false;
+  static bool _hasCorruptedAttributes(Element element) => false;

[Alan Knight, 2015/05/21 20:38:41]

Made this static, as suggested.

 $endif
 
 $if DART2JS
   @DomName('Element.offsetHeight')
   @DocsEditable()
   int get offsetHeight => JS('num', '#.offsetHeight', this).round();
 
   @DomName('Element.offsetLeft')
   @DocsEditable()
   int get offsetLeft => JS('num', '#.offsetLeft', this).round();
@@ skipping 146 matching lines @@
   const ScrollAlignment._internal(this._value);
   toString() => 'ScrollAlignment.$_value';
 
   /// Attempt to align the element to the top of the scrollable area.
   static const TOP = const ScrollAlignment._internal('TOP');
   /// Attempt to center the element in the scrollable area.
   static const CENTER = const ScrollAlignment._internal('CENTER');
   /// Attempt to align the element to the bottom of the scrollable area.
   static const BOTTOM = const ScrollAlignment._internal('BOTTOM');
 }