Re: [File Upload] Security problems with File Upload

On Fri, 22 Sep 2006, Robin Berjon wrote:
> > 
> > I would feel much more comfortable if the FileList API was provided 
> > merely as an extension to the HTMLInputElement interface, thus 
> > requiring authors to use an <input type=file> control, and requiring 
> > users to click the Browse button before the dialog would appear.
> 
> The problem with this solution is that it then requires that the 
> environment supports <input type=file>, which isn't always the case.

Hm. Could we split the spec into two parts, one for those environments 
without HTML, and one for those with? It would be good to keep the APIs 
for browsers to an absolute minimum, especially now with the ballooning 
number of new APIs that are being specified, and for HTML browsers I 
really think it would be much simpler (and safer) to stick this on the end 
of HTMLInputElement rather than have a whole new API.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'

Received on Friday, 22 September 2006 19:36:09 UTC