id: os_safari_allow_javascript_disable
title: Disable JavaScript in Safari
discussion: |-
  Safari JavaScript execution _MUST_ be disabled.

  JavaScript is a powerful scripting language that can be leveraged by malicious content to execute arbitrary code in the context of the browser, redirect users to malicious sites, or exfiltrate sensitive information. Disabling JavaScript reduces the attack surface associated with active mobile code in the web browser.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-XXXXX-X
    800-53r5:
      - SC-18
      - SC-18(4)
    800-171r3:
      - 03.13.15
  disa:
    cci:
      - CCI-001167
    srg:
      - SRG-OS-000480-GPOS-00228
    cmmc:
      - SC.L2-3.13.15
platforms:
  macOS:
    '27.0': {}
    '26.0': {}
    enforcement_info:
      check:
        shell: |-
          /usr/bin/osascript -l JavaScript << EOS
          $.NSUserDefaults.alloc.initWithSuiteName('com.apple.Safari')\
          .objectForKey('allowJavaScript').js
          EOS
        result:
          string: 'false'
    introduced: '-1'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
mobileconfig_info:
  - PayloadType: com.apple.Safari
    PayloadContent:
      - allowJavaScript: false
