Make sure NodeValidator uriAttributes aren't passed as attributes

tools/dom/src/NodeValidatorBuilder.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.dom.html;
 
 
 /**
  * Class which helps construct standard node validation policies.
  *
@@ skipping 241 matching lines @@
     return _validators.any((v) => v.allowsElement(element));
   }
 
   bool allowsAttribute(Element element, String attributeName, String value) {
     return _validators.any(
         (v) => v.allowsAttribute(element, attributeName, value));
   }
 }
 
 class _SimpleNodeValidator implements NodeValidator {
-  final Set<String> allowedElements;
-  final Set<String> allowedAttributes;
-  final Set<String> allowedUriAttributes;
+  final Set<String> allowedElements = new Set<String>();
+  final Set<String> allowedAttributes = new Set<String>();
+  final Set<String> allowedUriAttributes = new Set<String>();
   final UriPolicy uriPolicy;
 
   factory _SimpleNodeValidator.allowNavigation(UriPolicy uriPolicy) {
     return new _SimpleNodeValidator(uriPolicy,
-      allowedElements: [
+      allowedElements: const [
         'A',
         'FORM'],
-      allowedAttributes: [
+      allowedAttributes: const [
         'A::accesskey',
         'A::coords',
         'A::hreflang',
         'A::name',
         'A::shape',
         'A::tabindex',
         'A::target',
         'A::type',
         'FORM::accept',
         'FORM::autocomplete',
         'FORM::enctype',
         'FORM::method',
         'FORM::name',
         'FORM::novalidate',
         'FORM::target',
       ],
-      allowedUriAttributes: [
+      allowedUriAttributes: const [
         'A::href',
         'FORM::action',
       ]);
   }
 
   factory _SimpleNodeValidator.allowImages(UriPolicy uriPolicy) {
     return new _SimpleNodeValidator(uriPolicy,
-      allowedElements: [
+      allowedElements: const [
         'IMG'
       ],
-      allowedAttributes: [
+      allowedAttributes: const [
         'IMG::align',
         'IMG::alt',
         'IMG::border',
         'IMG::height',
         'IMG::hspace',
         'IMG::ismap',
         'IMG::name',
         'IMG::usemap',
         'IMG::vspace',
         'IMG::width',
       ],
-      allowedUriAttributes: [
+      allowedUriAttributes: const [
         'IMG::src',
       ]);
   }
 
   factory _SimpleNodeValidator.allowTextElements() {
     return new _SimpleNodeValidator(null,
-      allowedElements: [
+      allowedElements: const [
         'B',
         'BLOCKQUOTE',
         'BR',
         'EM',
         'H1',
         'H2',
         'H3',
         'H4',
         'H5',
         'H6',
         'HR',
         'I',
         'LI',
         'OL',
         'P',
         'SPAN',
         'UL',
       ]);
   }
 
   /**
    * Elements must be uppercased tag names. For example `'IMG'`.
    * Attributes must be uppercased tag name followed by :: followed by
    * lowercase attribute name. For example `'IMG:src'`.
    */
   _SimpleNodeValidator(this.uriPolicy,
       {Iterable<String> allowedElements, Iterable<String> allowedAttributes,
-      Iterable<String> allowedUriAttributes}):
-      this.allowedElements = allowedElements != null ?
-          new Set.from(allowedElements) : new Set(),
-      this.allowedAttributes = allowedAttributes != null ?
-          new Set.from(allowedAttributes) : new Set(),
-      this.allowedUriAttributes = allowedUriAttributes != null ?
-          new Set.from(allowedUriAttributes) : new Set();
+        Iterable<String> allowedUriAttributes}) {
+    this.allowedElements.addAll(allowedElements ?? const []);
+    allowedAttributes = allowedAttributes ?? const [];
+    allowedUriAttributes = allowedUriAttributes ?? const [];
+    var legalAttributes = allowedAttributes.where(
+        (x) => !_Html5NodeValidator._uriAttributes.contains(x));
+    var extraUriAttributes = allowedAttributes.where(
+        (x) => _Html5NodeValidator._uriAttributes.contains(x));
+    this.allowedAttributes.addAll(legalAttributes);
+    this.allowedUriAttributes.addAll(allowedUriAttributes);
+    this.allowedUriAttributes.addAll(extraUriAttributes);
+  }
 
   bool allowsElement(Element element) {
     return allowedElements.contains(element.tagName);
   }
 
   bool allowsAttribute(Element element, String attributeName, String value) {
     var tagName = element.tagName;
     if (allowedUriAttributes.contains('$tagName::$attributeName')) {
       return uriPolicy.allowsUri(value);
     } else if (allowedUriAttributes.contains('*::$attributeName')) {
@@ skipping 102 matching lines @@
     return false;
   }
 
   bool allowsAttribute(Element element, String attributeName, String value) {
     if (attributeName == 'is' || attributeName.startsWith('on')) {
       return false;
     }
     return allowsElement(element);
   }
 }