7

Our site is a private service -- that is, firewalls and user authorisation keeps both the general public and Google's indexing off it.

The site generates dynamic DocX files, which the customer downloads with their browser. It's been pretty much the same way for years.

This week we have started to intermittently see warnings in the Chrome downloads shelf:

Screenshot: "suitability-rep....docx is not commonly downloaded and may be dangerous"

I've dived into Chrome's safe browsing stuff and discovered that you can get diagnostics at chrome://safe-browsing/. There I can see that:

  • Chrome sends a safe browsing "ping" when it downloads .docx files
  • Most of the time the response to this contains "verdict": "SAFE"
  • Sometimes the response contains "verdict": "UNCOMMON", and this is when the user gets a warning.

I've also had a bit of a hunt through the Chromium source and Chrome blogs, and it doesn't look as if either Chrome's approach, nor its policy for the .docx file type has changed recently. All I can think of is that the Safe Browsing service has changed its rules.

Here's an anonymised ping payload that gave an UNCOMMON verdict:

{
   "archive_directory_count": 0,
   "archive_file_count": 0,
   "archived_binary": [  ],
   "download_type": 14,
   "file_basename": "doc.docx",
   "length": 493030,
   "referrer_chain": [ {
      "ip_addresses": [  ],
      "is_retargeting": false,
      "main_frame_url": "",
      "maybe_launched_by_external_application": false,
      "navigation_initiation": "UNDEFINED",
      "navigation_time_msec": 1.591196304544e+12,
      "referrer_main_frame_url": "",
      "referrer_url": "https://foo.bar/baz",
      "server_redirect_chain": [ "https://foo.bar/5ca70c26-9b9a-4cda-a99e-27394630910d" ],
      "type": "EVENT_URL",
      "url": "https://foo.bar/5ca70c26-9b9a-4cda-a99e-27394630910d"
   }, {
      "ip_addresses": [ "1.2.3.4" ],
      "is_retargeting": false,
      "main_frame_url": "",
      "maybe_launched_by_external_application": false,
      "navigation_initiation": "RENDERER_INITIATED_WITHOUT_USER_GESTURE",
      "navigation_time_msec": 1.591196217058e+12,
      "referrer_main_frame_url": "",
      "referrer_url": "https://foo.bar/baz/bap",
      "server_redirect_chain": [  ],
      "type": "LANDING_PAGE",
      "url": "https://foo.bar/baz"
   }, {
      "ip_addresses": [ "1.2.3.4" ],
      "is_retargeting": false,
      "main_frame_url": "",
      "maybe_launched_by_external_application": false,
      "navigation_initiation": "RENDERER_INITIATED_WITH_USER_GESTURE",
      "navigation_time_msec": 1.591196195633e+12,
      "referrer_main_frame_url": "",
      "referrer_url": "foo.bar/baz/bat",
      "server_redirect_chain": [  ],
      "type": "CLIENT_REDIRECT",
      "url": "https://foo.bar/bap"
   }, {
      "ip_addresses": [ "1.2.3.4" ],
      "is_retargeting": false,
      "main_frame_url": "",
      "maybe_launched_by_external_application": false,
      "navigation_initiation": "RENDERER_INITIATED_WITH_USER_GESTURE",
      "navigation_time_msec": 1.591196152516e+12,
      "referrer_main_frame_url": "",
      "referrer_url": "",
      "server_redirect_chain": [  ],
      "type": "LANDING_REFERRER",
      "url": "foo.bar/baz/bat"
   } ],
   "request_ap_verdicts": false,
   "url": "blob:https://foo.bar/5ca70c26-9b9a-4cda-a99e-27394630910d"
}

(The download is initiated by a user click on a React component which triggers Javascript using the file-saver library, which delivers it as a blob)

Google Search Console indicates no problems with our site -- which is to be expected because the site is private.

I understand that UNCOMMON means "we can't say this is safe because it's not a file we've seen before". It sort-of makes sense to me that our docx files could be described as uncommon, because each one is dynamically generated and therefore unique. However I don't understand why the service sometimes reaches a verdict of SAFE and sometimes UNCOMMON - at a guess there are some heuristics based on the contents of the referrer chain, but I've not been able to spot any correlations so far.

I know we can advise our users or their Enterprise admins to whitelist our site, and while this is certainly an option, I'd really like to not give them that inconvenience.

So, questions:

  • Does Google publish anything to explain their criteria for reaching an UNCOMMON verdict?
  • What can we do at the server side to prevent an UNCOMMON verdict?
  • Any other solutions to this problem?
  • Is there a reason why you're generating ".docx" files? Could you change to a format that's easier for Google to "like"? – Greg Nickoloff Jun 12 at 18:54
  • I wish 🙄. MS Word docs is what our customers want. – slim Jun 13 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.