Missed script escape scenario

[ssddanbrown]

Is prevented by CSP already, but good to prevent this case to benefit out-of-platform cases.

cases:

  Example 1)
  <svg><animate href=#xss attributeName=href from=javascript:alert(1) to=1 /><a id=xss><text x=20 y=20>XSS</text></a>
  Example 2)
  <svg><set href=#xss attributeName=href from=? to=javascript:alert(1) /><a id=xss><text x=20 y=20>XSS</text></a>

Thanks to the "JPCERT/CC Vulnerability Coordination Group" contact and the original reporter, Kenichi Okuno of Mitsui Bussan Secure Directions, Inc, again for disclosing of this case.