Disable JavaScript input in address bar - Firefox only

Question

I am looking for a way of doing this because my PC is used by more people. Just in case they need to see my saved passwords, they can just type some JavaScript in the address bar and voila..they can see the values of some of my login forms..

I googled and googled but found nothing that can help me customize Firefox by disabling the javascript: pseudo-protocol.

Any ideas?

Answer 1

If your machine is used by more than just you and those other users have the same rights to the machine that you have, then you can't disable JavaScript (or anything else) in a way that will prevent them re-enabling it. All modern OSes (including Windows, at least Vista and up and probably earlier) have the ability to restrict (even encrypt) the data in your account's home directory, which is where Firefox stores your information. If you use named user accounts on your system (whether it's Windows, Linux, Mac OS, etc.), you should be able to protect your privacy in a much more robust way than by trying to disable JavaScript.

Answer 2

There is one way to accomplish this. The NoScript extension adds the preference to disable Javascript in the url bar. You can find it by visiting 'about:config' and searching for 'noscript.allowURLBarJS' once you install the extension.

However, this does not actually help you in your circumstances, as stated in the other posts. I'm posting this for Googler's benefit.

May propose patching Fx to add this feature in the stock release regardless, for other security reasons.

Answer 3

Your question makes sense and I'm sure is solvable somehow, but your basic premise doesn't sound right.

, they can just type some JavaScript in the address bar and voila..they can see the values of some of my login forms..

Why? There should be no otherwise hidden form values that are somehow accessible through the Javascript protocol. I think either the sites you use have a serious security problem, or you are misunderstanding something.

Answer 4

Thanks for all your thoughts.

I managed to disable Tools -> Options -> Security -> Saved Passwords so nobody can look there for my saved passwords.

In order to explain my problem better, here's an example:

1. I have admin rights on my PC. The other users don't.
2. I have a basic CMS.
3. The login form fields such as the password one can be read by using the following piece of JavaScript code: javascript:(function(){var s,F,j,f,i; s = ""; F = document.forms; for(j=0; j

Thus, if I saved the username and password for later use, somebody else can access my login form, choose the username (was saved), then the password will show up in its field and the user can jus type the JavaScript code from above and an alert window will popup with my password. You can try that..just go to https://login.yahoo.com/config/login_verify2?.intl=us&.src=ym and enter an username and type a test pass. Then use the code from above.

That's just an example.

So, what I would like to do is:

1. disable window.alert in Firefox
2. or, disable JavaScript input in the browser address bar.

Thanks for all your help guys.

Answer 5

As Rushyo said, it can be done (I just tested it) by using that extension and alter noscript.allowURLBarJS by making it false instead of true. Then, I can block the access to about:config. However, how can we do that in a much simpler way, without the need of installing an extension?