Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/svg/SVGAnimateElement.h

Index: Source/core/svg/SVGAnimateElement.h
diff --git a/Source/core/svg/SVGAnimateElement.h b/Source/core/svg/SVGAnimateElement.h
index 709333069a1dc0fb851c99f0a74bf9ec9300f6b5..ae1247c05ff311717c1ad8641c5773aad77acfb4 100644
--- a/Source/core/svg/SVGAnimateElement.h
+++ b/Source/core/svg/SVGAnimateElement.h
@@ -28,6 +28,7 @@
 #include "core/svg/SVGAnimationElement.h"
 #include "platform/heap/Handle.h"
 #include "wtf/OwnPtr.h"
+#include <base/gtest_prod_util.h>
 
 namespace blink {
 
@@ -41,6 +42,8 @@ public:
 
     DECLARE_VIRTUAL_TRACE();
 
+    virtual bool isSVGAnimationAttributeSettingJavaScriptURL(const Attribute&) const override;
+
     AnimatedPropertyType animatedPropertyType();
     bool animatedPropertyTypeSupportsAddition();
 
@@ -63,6 +66,8 @@ protected:
     virtual void setTargetElement(SVGElement*) override final;
     virtual void setAttributeName(const QualifiedName&) override final;
 
+    FRIEND_TEST_ALL_PREFIXES(UnsafeSVGAttributeSanitizationTest, stringsShouldNotSupportAddition);
+
 private:
     void resetAnimatedPropertyType();