# SEC-007: data in the values of an animated link

**Error**: the page doesn't build until this is fixed.

An SVG `animate` or `set` that changes a link's `href` sets it to each of its `values` in turn. With data
there, a `javascript:` URL could slip in. `to` takes one URL, which Hypra checks like any link.

## Fails

```hypra fails
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(promo: Promo)
  h1 "Shoes"
  svg(viewBox: "0 0 100 20") {
    a(href: "/sale") {
      text(x: 0, y: 15) "Sale"
      animate(attributeName: "href", values: promo.links, dur: "10s")
    }
  }
}
```

## Fixed

```hypra passes
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(promo: Promo)
  h1 "Shoes"
  svg(viewBox: "0 0 100 20") {
    a(href: "/sale") {
      text(x: 0, y: 15) "Sale"
      animate(attributeName: "href", to: promo.link, dur: "10s")
    }
  }
}
```