Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/editing/Editor.h

Index: Source/core/editing/Editor.h
diff --git a/Source/core/editing/Editor.h b/Source/core/editing/Editor.h
index cf19d07618dc93502659713202a1c39fdc92c860..24b21bd65df42208d27b42bb55fbab0208f7788e 100644
--- a/Source/core/editing/Editor.h
+++ b/Source/core/editing/Editor.h
@@ -42,6 +42,7 @@
 namespace blink {
 
 class CompositeEditCommand;
+class DummyPageHolder;
 class EditCommandComposition;
 class EditorClient;
 class EditorInternalCommand;
@@ -279,6 +280,9 @@ private:
     SpellChecker& spellChecker() const;
 
     bool handleEditingKeyboardEvent(KeyboardEvent*);
+
+    // contentAfterPastingHTML is a helper function for unit tests.
+    friend String contentAfterPastingHTML(DummyPageHolder*, const char*);
 };
 
 inline void Editor::setStartNewKillRingSequence(bool flag)