3 ms·
This is a security nightmare. It looks like major browser vendors have pushed back against it and for good reason. Even a website I absolutely trust should not
by zelly 6y ago
This is a security nightmare. It looks like major browser vendors have pushed back against it and for good reason. Even a website I absolutely trust should not be able to access my bare filesystem because I don't know if that website will get compromised, XSS'd, DNS poisoned, etc.
I understand wanting to save files with a webapp, but why not just use LocalStorage and deserialize/serialize from that? If you need persistence plug in a cloud solution like Amazon S3. That's what the web is for.
- jarek-foksa 6y agoThe level of security seems to be on pair with Electron apps running inside macOS sandbox. Even if the attacker manages somehow to inject and execute a script on the client side, it will have access only to the files that user has opened with the app recently, not the entire filesystem.
- t0astbread 6y agoJudging by the web.dev page this seems to be pretty well done though. Permissions are only granted to a subset of files and new sessions will need to ask for permission again. LocalStorage is okay but a user might not be aware when LocalStorage is cleared (f.ex. they might accidentally clear it when deleting cookies). Cloud Storage might not be in the user's interest in terms of privacy. You kinda have to add some export/import functionality on top in both cases.