The URL protocol schemas "file" and "javascript" must be disabled
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-0021 | DTBC-0021 | SV-0021r1_rule | Medium |
| Description |
|---|
| Disables the listed protocol schemes in Google Chrome. URLs using a scheme from this list will not load and can not be navigated to. If this policy is left not set or the list is empty all schemes will be accessible in Google Chrome. |
| STIG | Date |
|---|---|
| Google Chrome STIG Draft | 2012-09-25 |
Details
| Check Text ( C-0021r1_chk ) |
|---|
| Universal method (Requires Chrome Browser v15 or later): 1. In the omnibox (address bar) type chrome://policy 2. If DisabledSchemes is displayed under the Policy Name column and it is set to file,javascript under the Policy Value column, then this is not a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\DisabledSchemes 3. If the DisabledSchemes key does not exist, or the 1 value name does not exist under that key and its value data is not set to file, or the 2 value name does not exist under that key and its value data is not set to javascript, then this is a finding.. |
| Fix Text (F-0021r1_fix) |
|---|
| Valid for Chrome Browser version 12 or later. Windows registry: Key Path: HKLM\Software\Policies\Google\Chrome\DisabledSchemes\ Value Name: 1 Value Type: String (REG_SZ) Value Data: file Key Path: HKLM\Software\Policies\Google\Chrome\DisabledSchemes\ Value Name: 2 Value Type: String (REG_SZ) Value Data: javascript Windows group policy: Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Disable URL protocol schemes Policy State: Enabled Policy Value 1: file Policy Value 2: javascript |