Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/svg/SVGAnimateElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 31 matching lines @@
 
 PassRefPtrWillBeRawPtr<SVGAnimateElement> SVGAnimateElement::create(Document& document)
 {
     return adoptRefWillBeNoop(new SVGAnimateElement(SVGNames::animateTag, document));
 }
 
 SVGAnimateElement::~SVGAnimateElement()
 {
 }
 
+bool SVGAnimateElement::isSVGAnimationAttributeSettingJavaScriptURL(const Attribute& attribute) const
+{
+    if ((attribute.name() == SVGNames::fromAttr || attribute.name() == SVGNames::toAttr) && attributeValueIsJavaScriptURL(attribute))
+        return true;
+
+    if (attribute.name() == SVGNames::valuesAttr) {
+        Vector<String> parts;
+        if (!parseValues(attribute.value(), parts)) {
+            // Assume the worst.
+            return true;
+        }
+        for (const auto& part : parts) {
+            if (protocolIsJavaScript(part))
+                return true;
+        }
+    }
+
+    return SVGSMILElement::isSVGAnimationAttributeSettingJavaScriptURL(attribute);
+}
+
 AnimatedPropertyType SVGAnimateElement::animatedPropertyType()
 {
     if (!targetElement())
         return AnimatedUnknown;
 
     m_animator.reset(targetElement());
     return m_animator.type();
 }
 
 bool SVGAnimateElement::hasValidAttributeType()
@@ skipping 328 matching lines @@
 {
     visitor->trace(m_fromProperty);
     visitor->trace(m_toProperty);
     visitor->trace(m_toAtEndOfDurationProperty);
     visitor->trace(m_animatedProperty);
     visitor->trace(m_animator);
     SVGAnimationElement::trace(visitor);
 }
 
 }