Index: sdk/lib/html/dartium/html_dartium.dart |
diff --git a/sdk/lib/html/dartium/html_dartium.dart b/sdk/lib/html/dartium/html_dartium.dart |
index c272f55c8658ef392d1e094b9231b54caa8eb409..2e7a051bbdd51f21ce560c3c466b8d7062c3931a 100644 |
--- a/sdk/lib/html/dartium/html_dartium.dart |
+++ b/sdk/lib/html/dartium/html_dartium.dart |
@@ -40752,6 +40752,9 @@ class _ValidatingTreeSanitizer implements NodeTreeSanitizer { |
var elementTagName = 'element tag unavailable'; |
try { |
elementTagName = element.tagName; |
+ if (elementTagName != elementTagName.toString() { |
+ corrupted = true; // The tag name is not a string |
+ } |
} catch(e) {} |
_sanitizeElement(element, parent, corrupted, elementText, elementTagName, |
attrs, isAttr); |
@@ -40807,7 +40810,7 @@ class _ValidatingTreeSanitizer implements NodeTreeSanitizer { |
void sanitizeNode(Node node, Node parent) { |
switch (node.nodeType) { |
case Node.ELEMENT_NODE: |
- _sanitizeUntrustedElement(node, parent); |
+ _sanitizeUntrustedElement(node, parent); |
break; |
case Node.COMMENT_NODE: |
case Node.DOCUMENT_FRAGMENT_NODE: |