TMA-CHROME-2.25

Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

СреднийУровень 1Автоматическаяchrome

Описание

This setting controls the ability for showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs to be called without user interaction. If the value for FileOrDirectoryPickerWithoutGestureAllowedForOrigins is not changed from the default, it will behave as if it is disabled. Rationale: Setting this policy would allow the URLs selected to call the showOpenFilePicker(), showSaveFilePicker(), and showDirectoryPicker() web APIs without any user gesture/interaction. This policy does not need to be set for this reason. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins is missing or empty, otherwise the configured entries.

Как проверяется

Метод проверки: Реестр Windows

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

Ожидаемый вывод: absent

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Allow file or directory picker APIs to be called without prior user gesture = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\FileOrDirectoryPickerWithoutGestureAllowedForOrigins after reviewing them.

Свойства

Операционные системы: Любая
Теги: chromebrowsercis-l1
Источник: CIS Google Chrome Benchmark v3.0.0 - 2.25 Ensure 'Allow file or directory picker APIs to be called without prior user gesture' Is Disabled

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target chrome