UCF STIG Viewer Logo

The URL protocol schema javascript must be disabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-44761 DTBC-0021 SV-57595r3_rule Medium
Description
Each access to a URL is handled by the browser according to the URL's "scheme". The "scheme" of a URL is the section before the ":". The term "protocol" is often mistakenly used for a "scheme". The difference is that the scheme is how the browser handles a URL and the protocol is how the browser communicates with a service. If a scheme or its associated protocol used by a browser is insecure or obsolete, vulnerabilities can be exploited resulting in exposed data or unrestricted access to the browser's system. The browser must be configured to disable the use of insecure and obsolete schemas (protocols). This policy disables the listed protocol schemes in Google Chrome, URLs using a scheme from this list will not load and cannot be navigated to. If this policy is left not set or the list is empty all schemes will be accessible in Google Chrome.
STIG Date
Google Chrome Browser STIG 2017-06-20

Details

Check Text ( C-49543r4_chk )
Universal method:
1. In the omnibox (address bar) type chrome://policy
2. If URLBlacklist is not displayed under the Policy Name column or it is not set to javascript://* under the Policy Value column, then this is a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\URLBlacklist
3. If the URLBlacklist key does not exist, or the does not contain entries 1 set to javascript://*, then this is a finding.

Fix Text (F-49853r5_fix)
Windows group policy:
1. Open the group policy editor tool with gpedit.msc
2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\
Policy Name: Block access to a list of URLs
Policy State: Enabled
Policy Value 1: javascript://*