Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/dom/Element.cpp

Index: Source/core/dom/Element.cpp
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index 29b4db06fdf6d4fd32fe08c5276991ba52010a8a..61995af8041ea76bada76e060b3e23d21cb3cf39 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -1245,9 +1245,14 @@ static inline bool isEventHandlerAttribute(const Attribute& attribute)
     return attribute.name().namespaceURI().isNull() && attribute.name().localName().startsWith("on");
 }
 
+bool Element::attributeValueIsJavaScriptURL(const Attribute& attribute)
+{
+    return protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(attribute.value()));
+}
+
 bool Element::isJavaScriptURLAttribute(const Attribute& attribute) const
 {
-    return isURLAttribute(attribute) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(attribute.value()));
+    return isURLAttribute(attribute) && attributeValueIsJavaScriptURL(attribute);
 }
 
 void Element::stripScriptingAttributes(Vector<Attribute>& attributeVector) const
@@ -1256,7 +1261,8 @@ void Element::stripScriptingAttributes(Vector<Attribute>& attributeVector) const
     for (size_t source = 0; source < attributeVector.size(); ++source) {
         if (isEventHandlerAttribute(attributeVector[source])
             || isJavaScriptURLAttribute(attributeVector[source])
-            || isHTMLContentAttribute(attributeVector[source]))
+            || isHTMLContentAttribute(attributeVector[source])
+            || isSVGAnimationAttributeSettingJavaScriptURL(attributeVector[source]))
             continue;
 
         if (source != destination)