Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/dom/Element.h

Index: Source/core/dom/Element.h
diff --git a/Source/core/dom/Element.h b/Source/core/dom/Element.h
index 24d598b0cfc59925326958217178c91404f84d75..a4bea2bd703d5a39f3cd92740b7977277a8ec6ae 100644
--- a/Source/core/dom/Element.h
+++ b/Source/core/dom/Element.h
@@ -354,6 +354,7 @@ public:
 
     virtual bool isURLAttribute(const Attribute&) const { return false; }
     virtual bool isHTMLContentAttribute(const Attribute&) const { return false; }
+    virtual bool isSVGAnimationAttributeSettingJavaScriptURL(const Attribute&) const { return false; }
 
     virtual bool isLiveLink() const { return false; }
     KURL hrefURL() const;
@@ -539,6 +540,8 @@ protected:
     // svgAttributeChanged (called when element.className.baseValue is set)
     void classAttributeChanged(const AtomicString& newClassString);
 
+    static bool attributeValueIsJavaScriptURL(const Attribute&);
+
     PassRefPtr<ComputedStyle> originalStyleForLayoutObject();
 
     Node* insertAdjacent(const String& where, Node* newChild, ExceptionState&);