directory-upload

directory-upload copied to clipboard

Security issue of directory upload: pretend to download when actaully to upload a directory

2

This issue was [reported by alibaba.com](https://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.IYip0H&id=3) and further demostrated [here](http://blog.knownsec.com/2015/11/html5-upload-folder-with-webkitdirectory-phishing/). For those who don't read Chinese, I rephrase this issue as follow: 1. A malicious web page show a button:...

duanyao

It is unclear how FormData object gets populated when Upload API is used

7

Upload API is async, but FormData[1] let's one to query items synchronously. https://xhr.spec.whatwg.org/#interface-formdata

smaug----

The [suggested user interface element text](https://wicg.github.io/directory-upload/proposal.html#dfn-distinct-file-and-directory-pickers) is "Choose directories". However, most users are familiar with the term "folder", not with "directory", so it should be renamed.

DanielHerr

Leading slash in FormData filename field

1

I noticed that https://github.com/WICG/directory-upload/commit/37d46d1b151a50666e74bb01064c563a37b94a27#diff-01b4f8e804865d25d17f3ea9bd7c417fL143 changed the `filename` field to include a leading slash. Is this change intentional? Uploads from `` don't include a leading slash in this field, and I...

silverwind

Consider renaming getDirectoriesAndFiles to fsitems or getFSItems

7

"getDirectoriesAndFiles" has two problems that I see: - The FileSystem API spec may at some point want to allow for things that are not files or directories. For example maybe...

jwatt

Consider how we could avoid the I/O blocking for FILE picking in addition to directory picking

5

We should consider we could avoid the I/O blocking for FILE picking in addition to directory picking. One way might be to allow getFilesAndDirectories to be used when a file...

jwatt

Consider changing the boolean param of getFiles to a dictionary

2

d.getFiles({recursive: true}) would be, IMO a bit more clear than d.getFiles(true), and by using dictionary we could extend the functionality easily later, if wanted. For example in the future we...

smaug----

easier way to determine if something is a directory?

7

I see in the examples that you do: ``` js filesAndDirs[i].getFilesAndDirectories === 'function' ``` This seems like a heavy handed way of filtering on "is a directory", no? Basically, what...

marcoscaceres

Should Directory be cloneable?

2

Scenario: - User drag-drops a directory onto a page - Page wants to delegate to its controlling Service Worker, so uses `postMessage()` This could be done by traversing the directory...

inexorabletash

Consider adding webkitrelativepath to the spec to be compatible with the web

2

If some compatibility check is done to support webkitdirectory [1], File objects should get webkitrelativepath property. [1] https://github.com/WICG/directory-upload/issues/29

smaug----