@r3866
http://codereview.appspot.com/159053/diff/1/3 File src/com/google/caja/plugin/bridal.js (right): http://codereview.appspot.com/159053/diff/1/3#newcode413 src/com/google/caja/plugin/bridal.js:413: - In IE[67], you can never change the type of an <button> element. On 2009/11/21 16:48:11, MikeSamuel wrote:
once added, or ever? So we rely on the extended createElement syntax for rendering buttons
correctly? same problem as <input>. caja RewriteHtmlStage emits <button> and <input> as static html, there's no createElement there anymore. domita setInnerHTML sanitizes a string that's assigned to the real .innerHTML, there's no createElement there. bridal cloneNode does do a createElement, and it handles <input> correctly but not <button>. I'll fix that later. http://codereview.appspot.com/159053/diff/1/3#newcode415 src/com/google/caja/plugin/bridal.js:415: throws an exception. We want the silent failure. On 2009/11/21 16:48:11, MikeSamuel wrote:
And the default type is 'submit', right?
in IE[67], the default type=button. which of course screws up a lot of pages when IE8 adopts the standards-compliant default type=submit http://codereview.appspot.com/159053/diff/1/3#newcode437 src/com/google/caja/plugin/bridal.js:437: return element.setAttribute(name, value, 0); On 2009/11/21 16:48:11, MikeSamuel wrote:
And this should only be reached on IE6/7, or should fail.
right. http://codereview.appspot.com/159053/diff/1/2 File tests/com/google/caja/plugin/domita_test_untrusted.html (right): http://codereview.appspot.com/159053/diff/1/2#newcode3080 tests/com/google/caja/plugin/domita_test_untrusted.html:3080: pass('testButtonMutation'); On 2009/11/21 16:48:11, MikeSamuel wrote:
Please move the pass outside the try.
done http://codereview.appspot.com/159053
