[OT] File inputs and Javascript

OT: I also find it interesting that I can do nothing with this field on the client side, pre-server validation with javascript for e.g.

I too have been bitten by this, but believe me it's a good idea. If this were not true, then any website you go to with Javascript turned on could have an invisible frame with a form and a file input button. Then a Javascript function could set the value to a known file location and submit it, and presto, some vital file from your hard drive has been whisked off to a server you don't know. I guess it could be less dangerous if it were read-only from scripts but even still...

Comment on [OT] File inputs and Javascript

Replies are listed 'Best First'.
Re: [OT] File inputs and Javascript by mpeters (Chaplain) on Jan 25, 2005 at 17:17 UTC
Even if it's read-only, it could potentially give the webpage at least knowledge of your file tree. And this is sometimes too much information.	[reply]
Re: [OT] File inputs and Javascript by ryantate (Friar) on Jan 26, 2005 at 00:54 UTC
a Javascript function could set the value to a known file location and submit it, and presto, some vital file from your hard drive has been whisked off to a server you don't know. This hypothetical is no different from what theoretically could happen with the current DOM-integrated file upload form element. As it happens, secure modern JS implementations do the right thing and do not allow the behavior you describe. I am no big JS apologist but I happen to be reading O'Reilly's "Javascript: The Definitive Guide" and this specific issue was just covered. I would welcome adding directory-upload functionality to client-side JS.	[reply]