Enforce form-action CSP even when form.target is present.

third_party/WebKit/Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights
  * reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 391 matching lines @@
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     document().addConsoleMessage(ConsoleMessage::create(
         SecurityMessageSource, ErrorMessageLevel,
         "Blocked form submission to '" + submission->action().elidedString() +
             "' because the form's frame is sandboxed and the 'allow-forms' "
             "permission is not set."));
     return;
   }
 
+  if (!document().contentSecurityPolicy()->allowFormAction(
+          submission->action())) {
+    return;
+  }
+
   if (protocolIsJavaScript(submission->action())) {
-    if (!document().contentSecurityPolicy()->allowFormAction(
-            submission->action()))
-      return;
     document().frame()->script().executeScriptIfJavaScriptURL(
         submission->action());
     return;
   }
 
   Frame* targetFrame = document().frame()->findFrameForNavigation(
       submission->target(), *document().frame());
   if (!targetFrame) {
     if (!LocalDOMWindow::allowPopUp(*document().frame()) &&
         !UserGestureIndicator::utilizeUserGesture())
@@ skipping 380 matching lines @@
   for (const auto& control : associatedElements()) {
     if (!control->isFormControlElement())
       continue;
     if (toHTMLFormControlElement(control)->canBeSuccessfulSubmitButton())
       toHTMLFormControlElement(control)->pseudoStateChanged(
           CSSSelector::PseudoDefault);
   }
 }
 
 }  // namespace blink