diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index 5f9de04..50599aa 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -731,7 +731,10 @@ protected function buildFormAction() {
     //   https://www.drupal.org/node/2504709.
     $parsed = UrlHelper::parse($request_uri);
     unset($parsed['query'][static::AJAX_FORM_REQUEST], $parsed['query'][MainContentViewSubscriber::WRAPPER_FORMAT]);
+
+    // Prevent multiple slashes to avoid cross site requests via the Form API.
     $parsed['path'] = '/' . ltrim($parsed['path'], '/');
+
     return $parsed['path'] . ($parsed['query'] ? ('?' . UrlHelper::buildQuery($parsed['query'])) : '');
   }
 
diff --git a/core/modules/system/src/Tests/Form/ExternalFormUrlTest.php b/core/modules/system/src/Tests/Form/ExternalFormUrlTest.php
index 35d22f78..8e03650 100644
--- a/core/modules/system/src/Tests/Form/ExternalFormUrlTest.php
+++ b/core/modules/system/src/Tests/Form/ExternalFormUrlTest.php
@@ -1,15 +1,13 @@
 <?php
+
 /**
  * @file
- * Contains \Drupal\system\Tests\Form\ExternalFormUrlTest
+ * Contains \Drupal\system\Tests\Form\ExternalFormUrlTest.
  */
 
 namespace Drupal\system\Tests\Form;
 
-
-use Drupal\Core\DependencyInjection\DependencySerializationTrait;
 use Drupal\Core\Form\FormInterface;
-use Drupal\Core\Form\FormState;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\simpletest\KernelTestBase;
 use Drupal\user\Entity\User;
@@ -23,9 +21,7 @@
 class ExternalFormUrlTest extends KernelTestBase implements FormInterface {
 
   /**
-   * Modules to enable.
-   *
-   * @var array
+   * {@inheritdoc}
    */
   public static $modules = ['user', 'system'];
 
@@ -65,10 +61,10 @@ protected function setUp() {
     $this->installSchema('system', ['key_value_expire', 'sequences']);
     $this->installEntitySchema('user');
 
-    $test_user = User::create(array(
+    $test_user = User::create([
       'name' => 'foobar',
       'mail' => 'foobar@example.com',
-    ));
+    ]);
     $test_user->save();
     \Drupal::service('current_user')->setAccount($test_user);