entity_embed_filter_format_edit_form_validate() should check if <drupal-entity> has attributes

Using your steps in issue summary, it should pass, as you don't specify that the 'Display embedded entities' checkbox should be checked. Without that filter, it shouldn't care what you do with the tag.

Actually I'm wrong, it should show an error that the button requires the entity embed filter.

I'm still trying to wrap my head around the bugs.

Steps to reproduce:
1) go to /admin/config/content/formats/add
1.5) set Name field.
2) select CKEditor
3) Drag an entity embed button to active toolbar
4) check 'Limit allowed HTML tags and correct faulty HTML'
5) set "Allowed HTML tags" to <a href hreflang> <em> <strong> <cite> <blockquote cite> <code> <ul type> <ol start type='1 A I'> <li> <dl> <dt> <dd> <h2 id='jump-*'> <h3 id> <h4 id> <h5 id> <h6 id> <drupal-entity>
6) press "Save configuration"

Expected, there should be an error that the button requires the entity_embed filter.

7) Reopen button
8) Observe the Allowed HTML tags have been automatically changed for you. <drupal-entity data-entity-type data-entity-uuid data-entity-embed-display data-entity-embed-display-settings data-align data-caption data-embed-button data-langcode alt title>
9) Again remove all the attributes from the drupal entity, set it back to <a href hreflang> <em> <strong> <cite> <blockquote cite> <code> <ul type> <ol start type='1 A I'> <li> <dl> <dt> <dd> <h2 id='jump-*'> <h3 id> <h4 id> <h5 id> <h6 id> <drupal-entity>
10) press "Save configuration"

Now you get the expected error.

The Node button requires among the allowed HTML tags.

So the bug seems to be when you initially don't check 'Display embedded entities' and manually set 'drupal-entity' element, you trick it into not validating.

Oh, and this is with the patch.

Ok, I can confirm the test case in the issue now. It passes validation despite the missing attributes having been removed.

But upon reopening the form, it looks like it added the attributes.

If I remove the attributes again and save, I get this error:

The Node button requires among the allowed HTML tags.

Which is the wrong error.

Testing again with the issue summary steps, I can confirm, it wrongly passes validation, and saves allowed_html without the attributes in the filter.format.filter_name.yml.

uuid: 2bc3425f-44cc-4c64-a51d-3133184e1a32
langcode: en
status: true
dependencies:
  module:
    - entity_embed
name: 'test 416'
format: test_416
weight: 0
filters:
  entity_embed:
    id: entity_embed
    provider: entity_embed
    status: true
    weight: 100
    settings: {  }
  filter_html:
    id: filter_html
    provider: filter
    status: true
    weight: -10
    settings:
      allowed_html: '<a href hreflang> <em> <strong> <cite> <blockquote cite> <code> <ul type> <ol start type=''1 A I''> <li> <dl> <dt> <dd> <h2 id=''jump-*''> <h3 id> <h4 id> <h5 id> <h6 id> <drupal-entity>'
      filter_html_help: true
      filter_html_nofollow: false

But the patch doesn't fix the validation issue yet.