Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

MédiaNível 1Automatizadachrome

Descrição

This setting controls the ability for showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs to be called without user interaction. If the value for FileOrDirectoryPickerWithoutGestureAllowedForOrigins is not changed from the default, it will behave as if it is disabled. Rationale: Setting this policy would allow the URLs selected to call the showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs without any user gesture/interaction. This policy does not need to be set for this reason. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins is missing or empty, otherwise the configured entries.

Como é verificado

Método de auditoria: Registro do Windows

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

Saída esperada: absent

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Allow file or directory picker APIs to be called without prior user gesture = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins after reviewing them.

Propriedades

Sistemas operacionais: Qualquer
Tags: chromebrowsercis-l1
Referência: CIS Google Chrome Benchmark v3.0.0 - 2.25 Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target chrome