XSRF has nothing to do with JavaScript.

A site is vulnerable to XSRF if it doesn't use tokens when performing critical operations, critical operations are (usually) performed using HTTP POST, which can be done via form submission... token generation and validation is done server side...

You can perform a successful XSRF attack in a browser with javascript completely disabled.