documentation_complete: true

title: 'Disable JavaScript''s Ability To Modify The Browser Appearance'

description: "JavaScript can configure and make changes to the web browser's appearance by\nspecifically hiding the status bar from view. This can disabled by \nsetting <tt>dom.disable_window_open_feature.status</tt> to <tt>true</tt>."

rationale: |-
    JavaScript can make changes to the browser’s appearance. This activity
    can help disguise an attack taking place in a minimized background window.
    Webpage authors can disable many features of a popup window that they open.
    This setting prevents the status bar from being hidden.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: ECSC-1
    stigid: DTBF185

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that JavaScript cannot change the browser appearance,
    run the following command:
    <pre>$ grep 'dom.disable_window_open_feature.status' <i>FIREFOX_INSTALL_DIR</i>/*.cfg</pre>
    The output should return:
    <pre>lockPref("dom.disable_window_open_feature.status", "true");</pre>
