Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/clipboard/Pasteboard.h

 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 28 matching lines @@
 class KURL;
 
 class Pasteboard {
     WTF_MAKE_NONCOPYABLE(Pasteboard); WTF_MAKE_FAST_ALLOCATED(Pasteboard);
 public:
     enum SmartReplaceOption {
         CanSmartReplace,
         CannotSmartReplace
     };
 
+    Pasteboard();

[dcheng, 2015/06/10 09:35:28]

Can we just use Pasteboard::generalPasteboard() in the unit test, so we don't
have to make this public?

+
     static Pasteboard* generalPasteboard();
     void writePlainText(const String&, SmartReplaceOption);
     void writeImage(Image*, const KURL&, const String& title);
     void writeDataObject(DataObject*);
     bool canSmartReplace();
     bool isHTMLAvailable();
     String plainText();
 
     // If no data is read, an empty string will be returned and all out parameters will be cleared.
     // If applicable, the page URL will be assigned to the KURL parameter.
     // fragmentStart and fragmentEnd are indexes into the returned markup that indicate
     // the start and end of the returned markup. If there is no additional context,
     // fragmentStart will be zero and fragmentEnd will be the same as the length of the markup.
     String readHTML(KURL&, unsigned& fragmentStart, unsigned& fragmentEnd);
 
     void writeHTML(const String& markup, const KURL& documentURL, const String& plainText, bool canSmartCopyOrDelete);
 
     bool isSelectionMode() const;
     void setSelectionMode(bool);
 
     WebClipboard::Buffer buffer() const { return m_buffer; }
 
 private:
-    Pasteboard();
-
     WebClipboard::Buffer m_buffer;
 };
 
 } // namespace blink
 
 #endif // Pasteboard_h