Enforce form-action CSP even when form.target is present.

third_party/WebKit/Source/core/html/HTMLFormElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLFormElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
index dd75c5daae1fbcb830b111b104382efebc578db8..4fbbaa02e4de6bc20b086f4304dec31d4d93fa8c 100644
--- a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
@@ -409,10 +409,12 @@ void HTMLFormElement::scheduleFormSubmission(FormSubmission* submission) {
     return;
   }
 
+  if (!document().contentSecurityPolicy()->allowFormAction(
+          submission->action())) {
+    return;
+  }
+
   if (protocolIsJavaScript(submission->action())) {
-    if (!document().contentSecurityPolicy()->allowFormAction(
-            submission->action()))
-      return;
     document().frame()->script().executeScriptIfJavaScriptURL(
         submission->action());
     return;