TMA-CHROME-2.25

Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

보통레벨 1자동chrome

설명

This setting controls the ability for showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs to be called without user interaction. If the value for FileOrDirectoryPickerWithoutGestureAllowedForOrigins is not changed from the default, it will behave as if it is disabled. Rationale: Setting this policy would allow the URLs selected to call the showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs without any user gesture/interaction. This policy does not need to be set for this reason. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins is missing or empty, otherwise the configured entries.

점검 방법

감사 방식: Windows 레지스트리

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

예상 출력: absent

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Allow file or directory picker APIs to be called without prior user gesture = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins after reviewing them.

속성

운영 체제: 모두
태그: chromebrowsercis-l1
참고 자료: CIS Google Chrome Benchmark v3.0.0 - 2.25 Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target chrome