fix spurious exception from button.setAttribute("type", x)

this fixes http://code.google.com/p/google-caja/issues/detail?id=1171

YUI was failing on IE[67] when trying to create
a YUI button using an existing <button>,
because it was trying to setAttribute("type", "button")
and that normally just fails silently on IE[67],
but throws an exception when using bridal.

[MikeSamuel, 2009-11-21 16:48:11]

LGTM

http://codereview.appspot.com/159053/diff/1/3
File src/com/google/caja/plugin/bridal.js (right):

http://codereview.appspot.com/159053/diff/1/3#newcode413
src/com/google/caja/plugin/bridal.js:413: - In IE[67], you can never change the
type of an <button> element.
once added, or ever?
So we rely on the extended createElement syntax for rendering buttons correctly?

http://codereview.appspot.com/159053/diff/1/3#newcode415
src/com/google/caja/plugin/bridal.js:415: throws an exception.  We want the
silent failure.
And the default type is 'submit', right?

http://codereview.appspot.com/159053/diff/1/3#newcode421
src/com/google/caja/plugin/bridal.js:421: 3rd argument.  setAttributeNode is
case-insensitive.
wow

http://codereview.appspot.com/159053/diff/1/3#newcode424
src/com/google/caja/plugin/bridal.js:424: error.  In IE[678] and Opera 10, it
fails without an error.
Thanks for documenting this so thoroughly.

http://codereview.appspot.com/159053/diff/1/3#newcode437
src/com/google/caja/plugin/bridal.js:437: return element.setAttribute(name,
value, 0);
And this should only be reached on IE6/7, or should fail.

http://codereview.appspot.com/159053/diff/1/2
File tests/com/google/caja/plugin/domita_test_untrusted.html (right):

http://codereview.appspot.com/159053/diff/1/2#newcode3080
tests/com/google/caja/plugin/domita_test_untrusted.html:3080:
pass('testButtonMutation');
Please move the pass outside the try.

[felix8a, 2009-11-23 23:52:11]

@r3866

http://codereview.appspot.com/159053/diff/1/3
File src/com/google/caja/plugin/bridal.js (right):

http://codereview.appspot.com/159053/diff/1/3#newcode413
src/com/google/caja/plugin/bridal.js:413: - In IE[67], you can never change the
type of an <button> element.
On 2009/11/21 16:48:11, MikeSamuel wrote:
> once added, or ever?
> So we rely on the extended createElement syntax for rendering buttons
correctly?

same problem as <input>.

caja RewriteHtmlStage emits <button> and <input> as static html, there's no
createElement there anymore.

domita setInnerHTML sanitizes a string that's assigned to the real .innerHTML,
there's no createElement there.

bridal cloneNode does do a createElement, and it handles <input> correctly but
not <button>.  I'll fix that later.

http://codereview.appspot.com/159053/diff/1/3#newcode415
src/com/google/caja/plugin/bridal.js:415: throws an exception.  We want the
silent failure.
On 2009/11/21 16:48:11, MikeSamuel wrote:
> And the default type is 'submit', right?

in IE[67], the default type=button.  which of course screws up a lot of pages
when IE8 adopts the standards-compliant default type=submit

http://codereview.appspot.com/159053/diff/1/3#newcode437
src/com/google/caja/plugin/bridal.js:437: return element.setAttribute(name,
value, 0);
On 2009/11/21 16:48:11, MikeSamuel wrote:
> And this should only be reached on IE6/7, or should fail.

right.

http://codereview.appspot.com/159053/diff/1/2
File tests/com/google/caja/plugin/domita_test_untrusted.html (right):

http://codereview.appspot.com/159053/diff/1/2#newcode3080
tests/com/google/caja/plugin/domita_test_untrusted.html:3080:
pass('testButtonMutation');
On 2009/11/21 16:48:11, MikeSamuel wrote:
> Please move the pass outside the try.

done

[MikeSamuel, 2009-11-24 04:50:07]

Ok.  I don't see the changes to domita_test_untrusted.html snapshotted.  But
assuming you submit with that in, LGTM.

Should we change the HTML schema to list button type as a required attribute so
that we warn when it's not present?