Make it easier and more efficient to use trusted HTML text

tests/html/trusted_html_tree_sanitizer_test.dart

+// Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+/// This tests HTML validation and sanitization, which is very important
+/// for prevent XSS or other attacks. If you suppress this, or parts of it
+/// please make it a critical bug and bring it to the attention of the
+/// dart:html maintainers.
+library trusted_html_tree_sanitizer_test;
+
+import 'dart:html';
+import 'dart:svg' as svg;
+import 'package:unittest/unittest.dart';
+import 'package:unittest/html_individual_config.dart';
+import 'utils.dart';
+import 'dart:js' as js;
+
+var oldAdoptNode;
+var jsDocument;
+
+/// We want to verify that with the trusted sanitizer we are not
+/// creating a document fragment. So make DocumentFragment operation
+/// throw.
+makeDocumentFragmentAdoptionThrow() {
+  var document = js.context['document'];
+  jsDocument = new js.JsObject.fromBrowserObject(document);
+  oldAdoptNode = jsDocument['adoptNode'];
+  jsDocument['adoptNode'] = null;
+}
+
+restoreOldAdoptNode() {
+  jsDocument['adoptNode'] = oldAdoptNode;
+}
+
+main() {
+  useHtmlIndividualConfiguration();
+
+  group('not_create_document_fragment', () {
+    setUp(makeDocumentFragmentAdoptionThrow);
+    tearDown(restoreOldAdoptNode);
+
+    test('setInnerHtml', () {
+      document.body.setInnerHtml('<div foo="baz">something</div>',
+          treeSanitizer: NodeTreeSanitizer.trusted);
+      expect(document.body.innerHtml, '<div foo="baz">something</div>');
+    });
+
+    test("appendHtml", () {
+      var oldStuff = document.body.innerHtml;
+      var newStuff = '<div rumplestiltskin="value">content</div>';
+      document.body.appendHtml(newStuff,
+          treeSanitizer: NodeTreeSanitizer.trusted);
+      expect(document.body.innerHtml, oldStuff + newStuff);
+    });
+  });
+
+  group('untrusted', () {
+    setUp(makeDocumentFragmentAdoptionThrow);
+    tearDown(restoreOldAdoptNode);
+    test('untrusted', () {
+      expect(() => document.body.innerHtml = "<p>anything</p>", throws);
+    });
+  });
+}