Stop javascript in chrome address bar

[Sheridan]

Anyone found a way of stopping direct commands being run in the chrome address bar? i.e javascript:alert('hi'); or similar?Javascript is enabled for many sites, but we have the usual idiots running single line scripts in there to generate 10000 messages - usually on their mates PC when his back is turned for 1 minute!

[FishCustard]

the usual idiots running single line scripts in there to generate 10000 messages - usually on their mates PC when his back is turned for 1 minute!

 

We had this at a previous school - I showed the (more competent...!) teachers how to remote-kill processes with Impero, which helped a little.

 

It also prompted a 'fork-bomb war' among the IT guys: who could come up with the most irritating infinitely replicating process. I think one of the techies won that with a batch script that filled the drive with nonsense .txt files as well as filling up the process table!

Edited December 14, 2018 by FishCustard

[Sheridan]

I'm surprised the Chrome templates don't allow this to be disabled, as it could be used more maliciously than just messing around!

[Marci]

Only way of stopping is via NoScript-esque Chrome extensions... there's nothing native to Chrome that will disallow it.

Firefox and Safari have JS via Address Bar disabled by default and require it to be specifically enabled for it to work.

Last I knew IE just used keyword filters on paste (ie: paste in code prefixed with javascript: and it'd remove the javascript:, but still didn't stop you adding it back again by hand afterwards or direct-typing it). Edge has active filtering in place that URI encodes javascript: uris so that they're parsed as javascript%3A therefore whatever you put in there just ends up being the topic for a search in your default engine.

 

All that said however, you'd need to also disable Developer Tools > JS Console in every browser, alongside the ability to inspect and edit HTML via the browser, and the ability to edit Favourites & Bookmarks (ie: to create bookmarklets) to put a complete stop to being able to perform self-XSS attacks via javascript: methods. (Or disable JS _entirely_).

 

Technically: behaviour / computer misuse. Deal with it via your AUP with relevant sanctions.

Edited December 14, 2018 by Marci

[mavhc]

Lock your computer when you're not using it, problem solved. If someone's wasting time then they get to spend twice as much time in detention, rounded up to whole hours.