diff --git c/core/modules/system/tests/modules/form_test/form_test.module w/core/modules/system/tests/modules/form_test/form_test.module
index 3e7c089..3895379 100644
--- c/core/modules/system/tests/modules/form_test/form_test.module
+++ w/core/modules/system/tests/modules/form_test/form_test.module
@@ -141,13 +141,6 @@ function form_test_menu() {
     'type' => MENU_CALLBACK,
   );
 
-  $items['form-test/checkbox'] = array(
-    'title' => t('Form test'),
-    'page callback' => 'drupal_get_form',
-    'page arguments' => array('_form_test_checkbox'),
-    'access callback' => TRUE,
-    'type' => MENU_CALLBACK,
-  );
   $items['form-test/select'] = array(
     'title' => t('Select'),
     'page callback' => 'drupal_get_form',
@@ -221,15 +214,7 @@ function form_test_menu() {
     'access callback' => TRUE,
   );
 
-  $items['form-test/disabled-elements'] = array(
-    'title' => t('Form test'),
-    'page callback' => 'drupal_get_form',
-    'page arguments' => array('_form_test_disabled_elements'),
-    'access callback' => TRUE,
-    'type' => MENU_CALLBACK,
-  );
-
-  $items['form-test/input-forgery'] = array(
+  $items['form-test/input-forgery-old'] = array(
     'title' => t('Form test'),
     'page callback' => 'drupal_get_form',
     'page arguments' => array('_form_test_input_forgery'),
diff --git c/core/modules/system/tests/modules/form_test/form_test.routing.yml w/core/modules/system/tests/modules/form_test/form_test.routing.yml
index 34e437d..17dc131 100644
--- c/core/modules/system/tests/modules/form_test/form_test.routing.yml
+++ w/core/modules/system/tests/modules/form_test/form_test.routing.yml
@@ -67,3 +67,24 @@ form_test.autocomplete_2:
     controller: '\Drupal\form_test\AutocompleteController::autocomplete1'
   requirements:
     _permission: 'access autocomplete test'
+
+form_test.checkbox:
+  pattern: '/form-test/checkbox'
+  defaults:
+    _form: '\Drupal\form_test\FormTestCheckboxForm'
+  requirements:
+    _access: 'TRUE'
+
+form_test.disabled_elements:
+  pattern: '/form-test/disabled-elements'
+  defaults:
+    _form: '\Drupal\form_test\FormTestDisabledElementsForm'
+  requirements:
+    _access: 'TRUE'
+
+form_test.input_forgery:
+  pattern: '/form-test/input-forgery'
+  defaults:
+    _form: '\Drupal\form_test\FormTestInputForgery'
+  requirements:
+    _access: 'TRUE'
diff --git c/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestCheckboxForm.php w/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestCheckboxForm.php
new file mode 100644
index 0000000..1db04a2
--- /dev/null
+++ w/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestCheckboxForm.php
@@ -0,0 +1,106 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\form_test\FormTestCheckboxForm.
+ */
+
+namespace Drupal\form_test;
+
+use Drupal\Core\Form\FormBase;
+use Symfony\Component\HttpFoundation\JsonResponse;
+
+/**
+ * Defines a test form using checkboxes.
+ */
+class FormTestCheckboxForm extends FormBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormID() {
+    return '_form_test_checkbox';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, array &$form_state) {
+
+    // A required checkbox.
+    $form['required_checkbox'] = array(
+      '#type' => 'checkbox',
+      '#required' => TRUE,
+      '#title' => 'required_checkbox',
+    );
+
+    // A disabled checkbox should get its default value back.
+    $form['disabled_checkbox_on'] = array(
+      '#type' => 'checkbox',
+      '#disabled' => TRUE,
+      '#return_value' => 'disabled_checkbox_on',
+      '#default_value' => 'disabled_checkbox_on',
+      '#title' => 'disabled_checkbox_on',
+    );
+    $form['disabled_checkbox_off'] = array(
+      '#type' => 'checkbox',
+      '#disabled' => TRUE,
+      '#return_value' => 'disabled_checkbox_off',
+      '#default_value' => NULL,
+      '#title' => 'disabled_checkbox_off',
+    );
+
+    // A checkbox is active when #default_value == #return_value.
+    $form['checkbox_on'] = array(
+      '#type' => 'checkbox',
+      '#return_value' => 'checkbox_on',
+      '#default_value' => 'checkbox_on',
+      '#title' => 'checkbox_on',
+    );
+
+    // But inactive in any other case.
+    $form['checkbox_off'] = array(
+      '#type' => 'checkbox',
+      '#return_value' => 'checkbox_off',
+      '#default_value' => 'checkbox_on',
+      '#title' => 'checkbox_off',
+    );
+
+    // Checkboxes with a #return_value of '0' are supported.
+    $form['zero_checkbox_on'] = array(
+      '#type' => 'checkbox',
+      '#return_value' => '0',
+      '#default_value' => '0',
+      '#title' => 'zero_checkbox_on',
+    );
+
+    // In that case, passing a #default_value != '0' means that the checkbox is off.
+    $form['zero_checkbox_off'] = array(
+      '#type' => 'checkbox',
+      '#return_value' => '0',
+      '#default_value' => '1',
+      '#title' => 'zero_checkbox_off',
+    );
+
+    $form['submit'] = array(
+      '#type' => 'submit',
+      '#value' => $this->t('Submit')
+    );
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, array &$form_state) {
+
+    $response = new JsonResponse($form_state['values']);
+
+    $response->send();
+
+    exit;
+
+  }
+
+}
diff --git c/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestDisabledElementsForm.php w/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestDisabledElementsForm.php
new file mode 100644
index 0000000..67060f5
--- /dev/null
+++ w/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestDisabledElementsForm.php
@@ -0,0 +1,239 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\form_test\FormTestDisabledElementsForm.
+ */
+
+namespace Drupal\form_test;
+
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Datetime\DrupalDateTime;
+use Symfony\Component\HttpFoundation\JsonResponse;
+
+
+/**
+ * Defines a test form using disabled elements.
+ */
+class FormTestDisabledElementsForm extends FormBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormID() {
+    return '_form_test_disabled_elements';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, array &$form_state) {
+
+    // Elements that take a simple default value.
+    foreach (array('textfield', 'textarea', 'search', 'tel', 'hidden') as $type) {
+      $form[$type] = array(
+        '#type' => $type,
+        '#title' => $type,
+        '#default_value' => $type,
+        '#test_hijack_value' => 'HIJACK',
+        '#disabled' => TRUE,
+      );
+    }
+
+    // Multiple values option elements.
+    foreach (array('checkboxes', 'select') as $type) {
+      $form[$type . '_multiple'] = array(
+        '#type' => $type,
+        '#title' => $type . ' (multiple)',
+        '#options' => array(
+          'test_1' => 'Test 1',
+          'test_2' => 'Test 2',
+        ),
+        '#multiple' => TRUE,
+        '#default_value' => array('test_2' => 'test_2'),
+        // The keys of #test_hijack_value need to match the #name of the control.
+        // @see FormsTestCase::testDisabledElements()
+        '#test_hijack_value' => $type == 'select' ? array('' => 'test_1') : array('test_1' => 'test_1'),
+        '#disabled' => TRUE,
+      );
+    }
+
+    // Single values option elements.
+    foreach (array('radios', 'select') as $type) {
+      $form[$type . '_single'] = array(
+        '#type' => $type,
+        '#title' => $type . ' (single)',
+        '#options' => array(
+          'test_1' => 'Test 1',
+          'test_2' => 'Test 2',
+        ),
+        '#multiple' => FALSE,
+        '#default_value' => 'test_2',
+        '#test_hijack_value' => 'test_1',
+        '#disabled' => TRUE,
+      );
+    }
+
+    // Checkbox and radio.
+    foreach (array('checkbox', 'radio') as $type) {
+      $form[$type . '_unchecked'] = array(
+        '#type' => $type,
+        '#title' => $type . ' (unchecked)',
+        '#return_value' => 1,
+        '#default_value' => 0,
+        '#test_hijack_value' => 1,
+        '#disabled' => TRUE,
+      );
+      $form[$type . '_checked'] = array(
+        '#type' => $type,
+        '#title' => $type . ' (checked)',
+        '#return_value' => 1,
+        '#default_value' => 1,
+        '#test_hijack_value' => NULL,
+        '#disabled' => TRUE,
+      );
+    }
+
+    // Weight, number, range.
+    foreach (array('weight', 'number', 'range') as $type) {
+      $form[$type] = array(
+        '#type' => $type,
+        '#title' => $type,
+        '#default_value' => 10,
+        '#test_hijack_value' => 5,
+        '#disabled' => TRUE,
+      );
+    }
+
+    // Color.
+    $form['color'] = array(
+      '#type' => 'color',
+      '#title' => 'color',
+      '#default_value' => '#0000ff',
+      '#test_hijack_value' => '#ff0000',
+      '#disabled' => TRUE,
+    );
+
+    // The #disabled state should propagate to children.
+    $form['disabled_container'] = array(
+      '#disabled' => TRUE,
+    );
+    foreach (array('textfield', 'textarea', 'hidden', 'tel', 'url') as $type) {
+      $form['disabled_container']['disabled_container_' . $type] = array(
+        '#type' => $type,
+        '#title' => $type,
+        '#default_value' => $type,
+        '#test_hijack_value' => 'HIJACK',
+      );
+    }
+
+    // Date.
+    $date = new DrupalDateTime('1978-11-01 10:30:00', 'Europe/Berlin');
+    $expected = array('date' => '1978-11-01 10:30:00', 'timezone_type' => 3, 'timezone' => 'Europe/Berlin',);
+    $form['disabled_container']['disabled_container_datetime'] = array(
+      '#type' => 'datetime',
+      '#title' => 'datetime',
+      '#default_value' => $date,
+      '#expected_value' => $expected,
+      '#test_hijack_value' => new DrupalDateTime('1978-12-02 11:30:00', 'Europe/Berlin'),
+      '#date_timezone' => 'Europe/Berlin',
+    );
+
+
+    // Try to hijack the email field with a valid email.
+    $form['disabled_container']['disabled_container_email'] = array(
+      '#type' => 'email',
+      '#title' => 'email',
+      '#default_value' => 'foo@example.com',
+      '#test_hijack_value' => 'bar@example.com',
+    );
+
+    // Try to hijack the URL field with a valid URL.
+    $form['disabled_container']['disabled_container_url'] = array(
+      '#type' => 'url',
+      '#title' => 'url',
+      '#default_value' => 'http://example.com',
+      '#test_hijack_value' => 'http://example.com/foo',
+    );
+
+    // Text format.
+    $form['text_format'] = array(
+      '#type' => 'text_format',
+      '#title' => 'Text format',
+      '#disabled' => TRUE,
+      '#default_value' => 'Text value',
+      '#format' => 'plain_text',
+      '#expected_value' => array(
+        'value' => 'Text value',
+        'format' => 'plain_text',
+      ),
+      '#test_hijack_value' => array(
+        'value' => 'HIJACK',
+        'format' => 'filtered_html',
+      ),
+    );
+
+    // Password fields.
+    $form['password'] = array(
+      '#type' => 'password',
+      '#title' => 'Password',
+      '#disabled' => TRUE,
+    );
+    $form['password_confirm'] = array(
+      '#type' => 'password_confirm',
+      '#title' => 'Password confirm',
+      '#disabled' => TRUE,
+    );
+
+    // Files.
+    $form['file'] = array(
+      '#type' => 'file',
+      '#title' => 'File',
+      '#disabled' => TRUE,
+    );
+    $form['managed_file'] = array(
+      '#type' => 'managed_file',
+      '#title' => 'Managed file',
+      '#disabled' => TRUE,
+    );
+
+    // Buttons.
+    $form['image_button'] = array(
+      '#type' => 'image_button',
+      '#value' => 'Image button',
+      '#disabled' => TRUE,
+    );
+    $form['button'] = array(
+      '#type' => 'button',
+      '#value' => 'Button',
+      '#disabled' => TRUE,
+    );
+    $form['submit_disabled'] = array(
+      '#type' => 'submit',
+      '#value' => 'Submit',
+      '#disabled' => TRUE,
+    );
+
+    $form['submit'] = array(
+      '#type' => 'submit',
+      '#value' => $this->t('Submit'),
+    );
+
+    return $form;
+
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, array &$form_state) {
+
+    $response = new JsonResponse($form_state['values']);
+
+    $response->send();
+
+    exit;
+
+  }
+
+}
diff --git c/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestInputForgery.php w/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestInputForgery.php
new file mode 100644
index 0000000..a30be10
--- /dev/null
+++ w/core/modules/system/tests/modules/form_test/lib/Drupal/form_test/FormTestInputForgery.php
@@ -0,0 +1,54 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\form_test\FormTestInputForgery.
+ */
+
+namespace Drupal\form_test;
+
+use Drupal\Core\Form\FormBase;
+use Symfony\Component\HttpFoundation\JsonResponse;
+
+/**
+ * Defines a form to test input forgery of enabled elements.
+ */
+class FormTestInputForgery extends FormBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormID() {
+    return '_form_test_input_forgery';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, array &$form_state) {
+
+    // For testing that a user can't submit a value not matching one of the
+    // allowed options.
+    $form['checkboxes'] = array(
+      '#type' => 'checkboxes',
+      '#options' => array(
+        'one' => 'One',
+        'two' => 'Two',
+      ),
+    );
+    $form['submit'] = array(
+      '#type' => 'submit',
+      '#value' => $this->t('Submit'),
+    );
+    return $form;
+
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, array &$form_state) {
+    return new JsonResponse($form_state['values']);
+  }
+
+}