Summary

Add missing set|values and set|from entries to the ATTRIBUTE_NO_BINDING security context, matching the existing protection on <animate>.

Problem

PR #67797 added ATTRIBUTE_NO_BINDING protection for SVG animation attributes to prevent javascript: URI injection via animated href. The fix protected <animate> completely (attributeName, to, from, values) but only partially protected <set> (attributeName, to).

The <set> element's values and from attributes were not registered in either:

1. Compile-time: dom_security_schema.ts — set|values and set|from missing from ATTRIBUTE_NO_BINDING list
2. Runtime: sanitization.ts — SECURITY_SENSITIVE_ELEMENTS['set'] missing values and from

Per SVG Animation (SMIL) specification, <set> inherits the values attribute from AnimationElement. The first value in the semicolon-separated list is used as the target value, equivalent to the to attribute.

Fix

Add set|values and set|from to both the compile-time security schema and runtime validation check, matching the existing entries for <animate>.

Test plan

• Verified animate|values and animate|from are already protected
• Verified set|values and set|from are NOT protected before this fix
• Fix adds identical entries to both compile-time and runtime checks