Safe DOM w/ fixes

tools/dom/templates/html/impl/impl_SVGElement.darttemplate

 // Copyright (c) 2011, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of $LIBRARYNAME;
 
 class _AttributeClassSet extends CssClassSetImpl {
   final Element _element;
 
   _AttributeClassSet(this._element);
@@ skipping 13 matching lines @@
     }
     return s;
   }
 
   void writeClasses(Set s) {
     _element.attributes['class'] = s.join(' ');
   }
 }
 
 $(ANNOTATIONS)$(CLASS_MODIFIERS)class $CLASSNAME$EXTENDS$IMPLEMENTS$NATIVESPEC {
+  static final _START_TAG_REGEXP = new RegExp('<(\\w+)');
+
   factory $CLASSNAME.tag(String tag) =>
-      _$(CLASSNAME)FactoryProvider.create$(CLASSNAME)_tag(tag);
-  factory $CLASSNAME.svg(String svg) =>
-      _$(CLASSNAME)FactoryProvider.create$(CLASSNAME)_svg(svg);
+      document.$dom_createElementNS("http://www.w3.org/2000/svg", tag);
+  factory $CLASSNAME.svg(String svg,
+      {NodeValidator validator, NodeTreeSanitizer treeSanitizer}) {
+
+    if (validator == null && treeSanitizer == null) {
+      validator = new NodeValidatorBuilder.common()..allowSvg();
+    }
+
+    final match = _START_TAG_REGEXP.firstMatch(svg);
+    var parentElement;
+    if (match != null && match.group(1).toLowerCase() == 'svg') {
+      parentElement = document.body;
+    } else {
+      parentElement = new SvgSvgElement();
+    }
+    var fragment = parentElement.createFragment(svg, validator: validator,
+        treeSanitizer: treeSanitizer);
+    return fragment.nodes.where((e) => e is SvgElement).single;
+  }
 
   _AttributeClassSet _cssClassSet;
   CssClassSet get classes {
     if (_cssClassSet == null) {
       _cssClassSet = new _AttributeClassSet(this);
     }
     return _cssClassSet;
   }
 
   List<Element> get children => new FilteredElementList<Element>(this);
@@ skipping 11 matching lines @@
     return container.innerHtml;
   }
 
   String get innerHtml {
     final container = new Element.tag("div");
     final SvgElement cloned = this.clone(true);
     container.children.addAll(cloned.children);
     return container.innerHtml;
   }
 
-  void set innerHtml(String svg) {
-    final container = new Element.tag("div");
-    // Wrap the SVG string in <svg> so that SvgElements are created, rather than
-    // HTMLElements.
-    container.innerHtml = '<svg version="1.1">$svg</svg>';
-    this.children = container.children[0].children;
+  void set innerHtml(String value) {
+    this.setInnerHtml(value);
+  }
+
+  DocumentFragment createFragment(String svg,
+      {NodeValidator validator, NodeTreeSanitizer treeSanitizer}) {
+
+    if (treeSanitizer == null) {
+      if (validator == null) {
+        validator = new NodeValidatorBuilder.common()
+          ..allowSvg();
+      }
+      treeSanitizer = new NodeTreeSanitizer(validator);
+    }
+
+    // We create a fragment which will parse in the HTML parser
+    var html = '<svg version="1.1">$svg</svg>';
+    var fragment = document.body.createFragment(html,
+        treeSanitizer: treeSanitizer);
+
+    var svgFragment = new DocumentFragment();
+    // The root is the <svg/> element, need to pull out the contents.
+    var root = fragment.nodes.single;
+    while (root.firstChild != null) {
+      svgFragment.append(root.firstChild);
+    }
+    return svgFragment;
   }
 
   // Unsupported methods inherited from Element.
 
   @DomName('Element.insertAdjacentText')
   void insertAdjacentText(String where, String text) {
     throw new UnsupportedError("Cannot invoke insertAdjacentText on SVG.");
   }
 
   @DomName('Element.insertAdjacentHTML')
@@ skipping 19 matching lines @@
    * Checks to see if the SVG element type is supported by the current platform.
    *
    * The tag should be a valid SVG element tag name.
    */
   static bool isTagSupported(String tag) {
     var e = new $CLASSNAME.tag(tag);
     return e is $CLASSNAME && !(e is UnknownElement);
   }
 $!MEMBERS
 }