- From: Thomas Suckow <thomas.suckow@pnnl.gov>
- Date: Wed, 25 Jun 2014 08:19:58 -0700
- To: public-html@w3.org
On 06/24/2014 11:55 PM, Drew DeVault wrote: > For well-justified security reasons, JavaScript cannot modify the value > of an input type="file". The worry is that they could set it to > "/etc/passwd" or something similar to learn about the user's filesystem. > > With recent extensions to how flexible JavaScript is with File objects, > being able to create them on the fly or fetch them from drag-and-drop > events, I think it's time to revisit this choice. > > Thoughts? > I am more interested in how the systems file chooser can be extended to choose items from filesystems or other data sources. ChromeOS appears to be investigating the ability for extensions to add file providers (Cloud Storage), I think it would be interesting if the current page could supply its own list of providers and indicate what kinds of data it can consume (possibly more than just files). In my current application I would like to be able to select data from a database or the local filesystem or a remote filesystem, right now it requires a button for the local filesystem, but if they could be unified it would give a better user experience (In my opinion). This would make sure the page never sees the system file providers but still allows it to extend the functionality. - Thomas
Received on Wednesday, 25 June 2014 17:21:57 UTC