Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/svg/SVGAnimationElement.cpp

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 34 matching lines @@
     , m_toPropertyValueType(RegularPropertyValue)
     , m_animationValid(false)
     , m_attributeType(AttributeTypeAuto)
     , m_hasInvalidCSSAttributeType(false)
     , m_calcMode(CalcModeLinear)
     , m_animationMode(NoAnimation)
 {
     UseCounter::count(document, UseCounter::SVGAnimationElement);
 }
 
-static bool parseValues(const String& value, Vector<String>& result)
+bool SVGAnimationElement::parseValues(const String& value, Vector<String>& result)
 {
     // Per the SMIL specification, leading and trailing white space,
     // and white space before and after semicolon separators, is allowed and will be ignored.
     // http://www.w3.org/TR/SVG11/animate.html#ValuesAttribute
     result.clear();
     Vector<String> parseList;
     value.split(';', true, parseList);
     unsigned last = parseList.size() - 1;
     for (unsigned i = 0; i <= last; ++i) {
         if (parseList[i].isEmpty()) {
@@ skipping 656 matching lines @@
         if (!hasInvalidCSSAttributeType)
             schedule();
     }
 
     // Clear values that may depend on the previous target.
     if (targetElement())
         clearAnimatedType();
 }
 
 }