Ensure 'Enable JavaScript' is 'Disabled'

Description

JavaScript enables web site authors to create enhanced user interfaces. In support of this, JavaScript enables web sites to programmatically read and alter the document object model (DOM) for the rendered web site as well as instantiate various objects, such as asynchronous XML HTTP request (XHR) objects. It is recommended that JavaScript be disabled. Rationale: JavaScript continues to be an attack vector for exploiting vulnerabilities in the browser. Additionally, JavaScript is commonly leveraged by exploit authors to create a deterministic memory layout in support of increasing the reliability of exploits. Audit reads WebKitJavaScriptEnabled from the com.apple.Safari preference domain of the account running the scan (the PDF checks the same token in com.apple.Safari.plist; manual check: Follow the below steps and verify that Enable JavaScript is Disabled: 1. Click Safari. 2. Click Preferences. 3. Click Security. 4. Verify Enable JavaScript is unchecked.). Safari is sandboxed, so the reading process needs Full Disk Access on macOS 10.14+. A missing key exits non-zero and is reported as FAIL even where the built-in default is compliant. Values forced by a configuration profile live in /Library/Managed Preferences and are not read here.

Properties

Operating systems

Any

Tags

safaribrowsercis-l2

Reference

CIS macOS Safari Benchmark v2.0.0 - 6.2 Ensure 'Enable JavaScript' is 'Disabled'