Title of input type="file" webkitdirectory suggests files will be uploaded even if files are only handled locally
Reported by
pabloand...@gmail.com,
Jul 24 2017
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3166.0 Safari/537.36 Steps to reproduce the problem: 1. put in the body of html something like: <input type="file" id="filepicker" name="fileList" webkitdirectory> 2. launch it in chromium Windows version 3. What is the expected behavior? The open folder dialog must say "select folder" What went wrong? The open folder dialog says "select folder to upload" Did this work before? N/A Does this work in other browsers? Yes Chrome version: 62.0.3166.0 Channel: n/a OS Version: 6.1 (Windows 7, Windows Server 2008 R2) Flash Version: To my knowledge this occur only in windows version because I am using this attribute (or also something semi equivalent in ns.js that is "nwdirectory") and this message appear only in windows version. Anyways I think is very frustrating because it gives a very bad impression to the user of the application or web application that the folder it is selecting is for upload. Please solve this!
,
Jul 25 2017
Able to reprodcue the issue using #62.0.3166.0 on Win 7 and 10. Obsereved the "select folder to upload" text. This seems to be a Non-Regression issue as same behavior is seen since M45. Hence untriaged to get more input's from dev. Please find the screenshot of Chrome M45. Note: 1. Issue is seen M62 as well. 2. Removed bisect label as this is a Non-Regression issue. Thanks!!
,
Dec 13 2017
In contrast, issue 780881 complains that the button name is not upload, thus making it less likely that the user will realize that the site is given access to all of the data. "Upload" seems correct to me as it's providing the same capability to the site: access to the file contents. Once granted access to the data, the site has the power to decide whether the data is processed locally or on the server. The nuance that network bandwidth may or may not be used is subtle. But the security UX folks should probably weigh in.
,
Dec 13 2017
Re #3: Yes, while it's technically true that the website might not elect to upload the selected content, in most cases today that is what will happen. From a security point-of-view, we want users to recognize that the folder selected could, at worst, be uploaded to the remote server, and they need to make their privacy decisions accordingly. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ligim...@chromium.org
, Jul 24 2017Labels: Needs-Bisect Needs-Triage-M62