Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1227 matching lines @@
 // Returns true is the given attribute is an event handler.
 // We consider an event handler any attribute that begins with "on".
 // It is a simple solution that has the advantage of not requiring any
 // code or configuration change if a new event handler is defined.
 
 static inline bool isEventHandlerAttribute(const Attribute& attribute)
 {
     return attribute.name().namespaceURI().isNull() && attribute.name().localName().startsWith("on");
 }
 
+bool Element::attributeValueIsJavaScriptURL(const Attribute& attribute)
+{
+    return protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(attribute.value()));
+}
+
 bool Element::isJavaScriptURLAttribute(const Attribute& attribute) const
 {
-    return isURLAttribute(attribute) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(attribute.value()));
+    return isURLAttribute(attribute) && attributeValueIsJavaScriptURL(attribute);
 }
 
 void Element::stripScriptingAttributes(Vector<Attribute>& attributeVector) const
 {
     size_t destination = 0;
     for (size_t source = 0; source < attributeVector.size(); ++source) {
         if (isEventHandlerAttribute(attributeVector[source])
             || isJavaScriptURLAttribute(attributeVector[source])
-            || isHTMLContentAttribute(attributeVector[source]))
+            || isHTMLContentAttribute(attributeVector[source])
+            || isSVGAnimationAttributeSettingJavaScriptURL(attributeVector[source]))
             continue;
 
         if (source != destination)
             attributeVector[destination] = attributeVector[source];
 
         ++destination;
     }
     attributeVector.shrink(destination);
 }
 
@@ skipping 2147 matching lines @@
 {
 #if ENABLE(OILPAN)
     if (hasRareData())
         visitor->trace(elementRareData());
     visitor->trace(m_elementData);
 #endif
     ContainerNode::trace(visitor);
 }
 
 } // namespace blink