Sanitize SVG animation attributes which could set JavaScript URL values.

Source/core/svg/SVGAnimationElement.h

Index: Source/core/svg/SVGAnimationElement.h
diff --git a/Source/core/svg/SVGAnimationElement.h b/Source/core/svg/SVGAnimationElement.h
index 9dcce6b37f5e04477c2dc711f1b9466a57e5ba1a..5fbacb25f1f9b4aa3c77f1b77047f8986c2f2f0e 100644
--- a/Source/core/svg/SVGAnimationElement.h
+++ b/Source/core/svg/SVGAnimationElement.h
@@ -29,6 +29,7 @@
 #include "core/svg/animation/SVGSMILElement.h"
 #include "platform/animation/UnitBezier.h"
 #include "wtf/Functional.h"
+#include "wtf/Vector.h"
 
 namespace blink {
 
@@ -168,6 +169,13 @@ protected:
     void setAnimationMode(AnimationMode animationMode) { m_animationMode = animationMode; }
     void setCalcMode(CalcMode calcMode) { m_calcMode = calcMode; }
 
+    // Parses a list of values as specified by SVG, stripping leading
+    // and trailing whitespace, and places them in result. If the
+    // format of the string is not valid, parseValues empties result
+    // and returns false. See
+    // http://www.w3.org/TR/SVG/animate.html#ValuesAttribute .
+    static bool parseValues(const String&, Vector<String>& result);
+
 private:
     virtual bool isValid() const override final { return SVGTests::isValid(document()); }