Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/svg/SVGAnimateElement.cpp

Index: Source/core/svg/SVGAnimateElement.cpp
diff --git a/Source/core/svg/SVGAnimateElement.cpp b/Source/core/svg/SVGAnimateElement.cpp
index 1a0c271c588b682896d0fd8ce7381eda592b3ac7..ea8c6ee4d89d6a03aba2bdaf62b3a66ea380219d 100644
--- a/Source/core/svg/SVGAnimateElement.cpp
+++ b/Source/core/svg/SVGAnimateElement.cpp
@@ -49,6 +49,26 @@ SVGAnimateElement::~SVGAnimateElement()
 {
 }
 
+bool SVGAnimateElement::isSVGAnimationAttributeSettingJavaScriptURL(const Attribute& attribute) const
+{
+    if ((attribute.name() == SVGNames::fromAttr || attribute.name() == SVGNames::toAttr) && attributeValueIsJavaScriptURL(attribute))
+        return true;
+
+    if (attribute.name() == SVGNames::valuesAttr) {
+        Vector<String> parts;
+        if (!parseValues(attribute.value(), parts)) {
+            // Assume the worst.
+            return true;
+        }
+        for (const auto& part : parts) {
+            if (protocolIsJavaScript(part))
+                return true;
+        }
+    }
+
+    return SVGSMILElement::isSVGAnimationAttributeSettingJavaScriptURL(attribute);
+}
+
 AnimatedPropertyType SVGAnimateElement::animatedPropertyType()
 {
     if (!targetElement())