Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

MittelStufe 1Automatisiertchrome

Beschreibung

This setting controls the ability for showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs to be called without user interaction. If the value for FileOrDirectoryPickerWithoutGestureAllowedForOrigins is not changed from the default, it will behave as if it is disabled. Rationale: Setting this policy would allow the URLs selected to call the showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs without any user gesture/interaction. This policy does not need to be set for this reason. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins is missing or empty, otherwise the configured entries.

So wird geprüft

Prüfmethode: Windows-Registrierung

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

Erwartete Ausgabe: absent

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Allow file or directory picker APIs to be called without prior user gesture = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins after reviewing them.

Eigenschaften

Betriebssysteme: Beliebig
Tags: chromebrowsercis-l1
Referenz: CIS Google Chrome Benchmark v3.0.0 - 2.25 Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target chrome