Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/svg/SVGAnimationElement.h

 /*
  * Copyright (C) 2004, 2005 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
  * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Cameron McCormack <cam@mcc.id.au>
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 11 matching lines @@
  * Boston, MA 02110-1301, USA.
  */
 
 #ifndef SVGAnimationElement_h
 #define SVGAnimationElement_h
 
 #include "core/svg/SVGAnimatedBoolean.h"
 #include "core/svg/animation/SVGSMILElement.h"
 #include "platform/animation/UnitBezier.h"
 #include "wtf/Functional.h"
+#include "wtf/Vector.h"
 
 namespace blink {
 
 class ExceptionState;
 
 enum AnimationMode {
     NoAnimation,
     FromToAnimation,
     FromByAnimation,
     ToAnimation,
@@ skipping 119 matching lines @@
 
     virtual void setTargetElement(SVGElement*) override;
     virtual void setAttributeName(const QualifiedName&) override;
 
     bool hasInvalidCSSAttributeType() const { return m_hasInvalidCSSAttributeType; }
 
     virtual void updateAnimationMode();
     void setAnimationMode(AnimationMode animationMode) { m_animationMode = animationMode; }
     void setCalcMode(CalcMode calcMode) { m_calcMode = calcMode; }
 
+    // Parses a list of values as specified by SVG, stripping leading
+    // and trailing whitespace, and places them in result. If the
+    // format of the string is not valid, parseValues empties result
+    // and returns false. See
+    // http://www.w3.org/TR/SVG/animate.html#ValuesAttribute .
+    static bool parseValues(const String&, Vector<String>& result);
+
 private:
     virtual bool isValid() const override final { return SVGTests::isValid(document()); }
 
     virtual void animationAttributeChanged() override;
     void setAttributeType(const AtomicString&);
 
     void checkInvalidCSSAttributeType();
 
     virtual bool calculateToAtEndOfDurationValue(const String& toAtEndOfDurationString) = 0;
     virtual bool calculateFromAndToValues(const String& fromString, const String& toString) = 0;
@@ skipping 26 matching lines @@
     String m_lastValuesAnimationFrom;
     String m_lastValuesAnimationTo;
     bool m_hasInvalidCSSAttributeType;
     CalcMode m_calcMode;
     AnimationMode m_animationMode;
 };
 
 } // namespace blink
 
 #endif // SVGAnimationElement_h