documentation_complete: true

title: 'Disable JavaScript Context Menus'

description: |-
    JavaScript can configure and make changes to the web browser's appearance by
    specifically disabling or replacing context menus. This can be disabled by
    setting <tt>dom.event.contextmenu.enabled</tt> to <tt>false</tt>.

rationale: |-
    A website may execute JavaScript that can make changes to these
    context menus. This can help disguise an attack.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: ECSC-1
    stigid: DTBF183

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that JavaScript cannot change context menus,
    run the following command:
    <pre>$ grep 'dom.event.contextmenu.enabled' <i>FIREFOX_INSTALL_DIR</i>/*.cfg</pre>
    The output should return:
    <pre>lockPref("dom.event.contextmenu.enabled", "false");</pre>
