.../ckeditor/js/plugins/drupalimage/plugin.js      | 67 +++++++++++-----------
 .../js/plugins/drupalimagecaption/plugin.js        |  2 +-
 .../ckeditor/js/plugins/drupallink/plugin.js       |  1 +
 3 files changed, 36 insertions(+), 34 deletions(-)

diff --git a/core/modules/ckeditor/js/plugins/drupalimage/plugin.js b/core/modules/ckeditor/js/plugins/drupalimage/plugin.js
index 3dcced8..0ce9219 100644
--- a/core/modules/ckeditor/js/plugins/drupalimage/plugin.js
+++ b/core/modules/ckeditor/js/plugins/drupalimage/plugin.js
@@ -24,52 +24,53 @@
       // Override the image2 widget definition to require and handle the
       // additional data-entity-type and data-entity-uuid attributes.
       editor.on('widgetDefinition', function (event) {
-        var i;
         var widgetDefinition = event.data;
         if (widgetDefinition.name !== 'image') {
           return;
         }
 
-        // Override requiredContent & allowedContent.
-        widgetDefinition.requiredContent = new CKEDITOR.style({
-          element: 'img',
-          styles: {},
-          attributes: {
-            'alt': '',
-            'src': '',
-            'width': '',
-            'height': '',
-            'data-entity-type': '',
-            'data-entity-uuid': ''
-          }
-        });
-        var allowedContent = {
+        // First, convert requiredContent & allowedContent from the string
+        // format that image2 uses for both to formats that are better suited
+        // for extending, so that both this basic drupalimage plugin and Drupal
+        // modules can easily extend it.
+        // @see http://docs.ckeditor.com/#!/api/CKEDITOR.filter.allowedContentRules
+        // Mapped from image2's allowedContent. Unlike image2, we don't allow
+        // <figure>, <figcaption>, <div> or <p>  in our downcast, so we omit
+        // those. For the <img> tag, we list all attributes it lists, but omit
+        // the classes, because the listed classes are for alignment, and for
+        // alignment we use the data-align attribute.
+        widgetDefinition.allowedContent = {
           img: {
             attributes: {
-              '!data-entity-type': '',
-              '!data-entity-uuid': ''
+              '!src': true,
+              '!alt': true,
+              'width': true,
+              'height': true
             },
             classes: {},
             styles: {}
           }
         };
-        var imgAttributes = widgetDefinition.allowedContent.img.attributes.split(/\s*,\s*/);
-        for (i = 0; i < imgAttributes.length; i++) {
-          allowedContent.img.attributes[imgAttributes[i]] = true;
-        }
-        if (widgetDefinition.allowedContent.img.classes) {
-          var classes = widgetDefinition.allowedContent.img.classes.split(/\s*,\s*/);
-          for (i = 0; i < classes.length; i++) {
-            allowedContent.img.classes[classes[i]] = true;
-          }
-        }
-        if (widgetDefinition.allowedContent.img.styles) {
-          var imgStyles = widgetDefinition.allowedContent.img.styles.split(/\s*,\s*/);
-          for (i = 0; i < imgStyles.length; i++) {
-            allowedContent.img.styles[imgStyles[i]] = true;
+        // Mapped from image2's requiredContent: "img[src,alt]". This does not
+        // use the object format unlike above, but a CKEDITOR.style instance,
+        // because requiredContent does not support the object format.
+        // @see https://www.drupal.org/node/2585173#comment-10456981
+        widgetDefinition.requiredContent = new CKEDITOR.style({
+          element: 'img',
+          styles: {},
+          attributes: {
+            src: '',
+            alt: ''
           }
-        }
-        widgetDefinition.allowedContent = allowedContent;
+        });
+
+        // Extend requiredContent & allowedContent.
+        var requiredContent = widgetDefinition.requiredContent.getDefinition();
+        requiredContent.attributes['data-entity-type'] = '';
+        requiredContent.attributes['data-entity-uuid'] = '';
+        widgetDefinition.requiredContent = new CKEDITOR.style(requiredContent);
+        widgetDefinition.allowedContent.img.attributes['!data-entity-type'] = true;
+        widgetDefinition.allowedContent.img.attributes['!data-entity-uuid'] = true;
 
         // Override the 'link' part, to completely disable image2's link
         // support: http://dev.ckeditor.com/ticket/11341.
diff --git a/core/modules/ckeditor/js/plugins/drupalimagecaption/plugin.js b/core/modules/ckeditor/js/plugins/drupalimagecaption/plugin.js
index ae427e0..731c982 100644
--- a/core/modules/ckeditor/js/plugins/drupalimagecaption/plugin.js
+++ b/core/modules/ckeditor/js/plugins/drupalimagecaption/plugin.js
@@ -50,7 +50,7 @@
           }
         }, true);
 
-        // Override requiredContent & allowedContent.
+        // Extend requiredContent & allowedContent.
         var requiredContent = widgetDefinition.requiredContent.getDefinition();
         requiredContent.attributes['data-align'] = '';
         requiredContent.attributes['data-caption'] = '';
diff --git a/core/modules/ckeditor/js/plugins/drupallink/plugin.js b/core/modules/ckeditor/js/plugins/drupallink/plugin.js
index 7f638cb..f797742 100644
--- a/core/modules/ckeditor/js/plugins/drupallink/plugin.js
+++ b/core/modules/ckeditor/js/plugins/drupallink/plugin.js
@@ -19,6 +19,7 @@
               '!href': true,
               'target': true
             },
+            classes: {},
             styles: {}
           }
         },