[whatwg] related subject -- access to local files RE: Forms: <input type=file> and directory tree picking

[David Dailey]

A few years ago, probably on www-html5, I remember posing a question about
enabling the once-unbroken ability to allow JavaScript with user-consent, to
insert an image file (as the src of an <img> into a web page, viewed in the
browser).

It all used to be easy and worked in the two relevant browsers at the time:
Netscape and IE. Then someone decided it was a security risk and that it
preserved the privacy of the end user more to force him or her to upload the
image to the server, create a round-trip from server to client and thence to
be able to view a local image in a local web page. The old functionality
continued to work in Netscape until its demise, and in IE until maybe
version 6. The other browsers viewed the security risk as too high and
ultimately IE seems to have agreed, hence breaking previous functionality.

Of course, this seems just like what evil empires might define as
"security": forcing someone to upload all their stuff to a 'cloud' where
always virtuous entities can protect us! I was most encouraged to hear that
in some years forward from that time, we might actually regain the
functionality we enjoyed in the early part of the previous decade!

Anyhow, as I recall, at the time, Hixie commented and someone else chimed in
with details (that seemed rather convoluted at the time) saying that it was
something people were working on. Has this effort led to fruition? It has
always seemed part and parcel to my concept of "web applications" and until
the "Design Principles" including "Don't Break the Web" came along, it
seemed to work quite well. 

Apologies if this is not the right place to ask questions about web
functionality. The HTML/CSS/forms/whatwg/W3C nomenclature and jurisdictional
issues are something that I haven't been quite able to follow with the
attention that it would seem to require.

Cheers
David

-----Original Message-----
From: whatwg-bounces at lists.whatwg.org
[mailto:whatwg-bounces at lists.whatwg.org] On Behalf Of Jonas Sicking
Sent: Wednesday, October 02, 2013 4:36 PM
To: Glenn Maynard
Cc: WHAT Working Group; Jonathan Watt; Ian Hickson
Subject: Re: [whatwg] Forms: <input type=file> and directory tree picking

On Wed, Oct 2, 2013 at 11:52 AM, Glenn Maynard <glenn at zewt.org> wrote:
> On Wed, Oct 2, 2013 at 1:02 PM, Jonas Sicking <jonas at sicking.cc> wrote:
>>
>> > That's not the only alternative. For example, a third alternative 
>> > is that the user's selection (e.g. a directory) is returned 
>> > quickly, not pre-expanded, and then any uploading happens in the 
>> > background with the author script doing the walk and uploading the 
>> > files.
>>
>> It's unclear to me what you are proposing here. Can you elaborate?
>
> The same thing I did, I think: an API to navigate the directory tree 
> as needed, and to never greedily recursing the directory tree.

Unfortunately that's forbidden by current specs. Or rather, the only
implementation strategy that I can see for doing that while implementing the
current spec would require synchronously traversing the full directory tree
whenever element.files is accessed. At least to me that would have
performance issues that are unacceptable to Firefox.

Though of course you or anyone else is free to propose changes to the spec
to improve that situation.

/ Jonas