Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/svg/SVGAnimateElement.cpp

Index: Source/core/svg/SVGAnimateElement.cpp
diff --git a/Source/core/svg/SVGAnimateElement.cpp b/Source/core/svg/SVGAnimateElement.cpp
index 1a0c271c588b682896d0fd8ce7381eda592b3ac7..958447a8a6c57ed313d4e761bc55689be28d21ab 100644
--- a/Source/core/svg/SVGAnimateElement.cpp
+++ b/Source/core/svg/SVGAnimateElement.cpp
@@ -49,6 +49,26 @@ SVGAnimateElement::~SVGAnimateElement()
 {
 }
 
+bool SVGAnimateElement::isSVGAnimationAttributeSettingJavaScriptURL(const Attribute& attribute) const
+{
+    if ((attribute.name() == SVGNames::fromAttr || attribute.name() == SVGNames::toAttr) && attributeValueIsJavaScriptURL(attribute))
+        return true;
+
+    if (attribute.name() == SVGNames::valuesAttr) {
+        Vector<String> parts;
+        if (!parseValues(attribute.value(), parts)) {
+            // Assume the worst.
+            return true;
+        }
+        for (auto part : parts) {

[dcheng, 2015/06/10 09:35:28]

This copies a String on each iteration. While Blink String objects are cheap to
copy, for (const auto& part : parts) would result in no copy at all.

+            if (protocolIsJavaScript(part))
+                return true;
+        }
+    }
+
+    return SVGSMILElement::isSVGAnimationAttributeSettingJavaScriptURL(attribute);
+}
+
 AnimatedPropertyType SVGAnimateElement::animatedPropertyType()
 {
     if (!targetElement())