Form submission should abort before constraint validation if sandboxed forms flag is set.

third_party/WebKit/Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 278 matching lines @@
     }
     return false;
 }
 
 void HTMLFormElement::prepareForSubmission(Event* event)
 {
     LocalFrame* frame = document().frame();
     if (!frame || m_isSubmittingOrInUserJSSubmitEvent)
         return;
 
+    if (document().isSandboxed(SandboxForms)) {
+        document().addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Blocked form submission to '" + m_attributes.action() + "' because the form's frame is sandboxed and the 'allow-forms' permission is not set."));
+        return;
+    }
+
     bool skipValidation = !document().page() || noValidate();
     ASSERT(event);
     HTMLFormControlElement* submitElement = submitElementFromEvent(event);
     if (submitElement && submitElement->formNoValidate())
         skipValidation = true;
 
     UseCounter::count(document(), UseCounter::FormSubmissionStarted);
     // Interactive validation must be done before dispatching the submit event.
     if (!skipValidation && !validateInteractively())
         return;
@@ skipping 475 matching lines @@
 {
     for (const auto& control : associatedElements()) {
         if (!control->isFormControlElement())
             continue;
         if (toHTMLFormControlElement(control)->canBeSuccessfulSubmitButton())
             toHTMLFormControlElement(control)->pseudoStateChanged(CSSSelector::PseudoDefault);
     }
 }
 
 } // namespace blink