Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

window.showDirectoryPicker opens up a whole new world

steveharrison.dev

Post reply on HN
Print view View original

11–20 of 122 posts

Re: window.showDirectoryPicker opens up a whole new world

#12

Post by znpy »

> Chrome introduced a new API, window.showDirectoryPicker() that allows the user to grant access to a directory on their computer and allow a website to read/write everything inside.

I mean, what could go wrong?

It's not like an user is tricked into uploading a file from a folder (let's say, the main "Documents" folder) and some malicious website steals all the files over there.

Re: window.showDirectoryPicker opens up a whole new world

#15

Post by explodes »

explodes wrote: post #9

First time I've heard about this. I'll have to look into the security model around it. I'm curious what safeguards are in place to prevent click jacking. I know showing a file picker """should""" be enough of a warning to users to be careful, but it's not hard to imagine a world where a couple of fish accidentally bite the bait of an allow-button, or because they followed instructions they incorrectly trusted.

Looks like these safeguards are in place:

* System and root directories cannot be selected. * Can only being activated after user action. * Requires https. * Double-confirmation for write access.

No API like this could ever be bulletproof, but it's a start I guess.

Very cool API though, and it really does open up a whole new world of possibilities.

Re: window.showDirectoryPicker opens up a whole new world

#16

Post by tantalor »

bigrocketapps wrote: post #10

Currently using this in socket2.me Not truly supported across all mobile browser currently, but it's certainly better than just one year ago.

https://caniuse.com/mdn-api_window_showdirectorypicker

* Global 75.2%

Mainly missing Safari and Firefox

Re: window.showDirectoryPicker opens up a whole new world

#18

Post by AlienRobot »

jaen wrote: post #11

Unfortunately currently only supported by Chrome/Chromium: https://developer.mozilla.org/en-US/docs/Web/API/Window/show...

Chromium has around the same market share as Windows, so at this point I feel people are targeting it as a web application development platform just as people target Windows.

Re: window.showDirectoryPicker opens up a whole new world

#19

Post by tantalor »

Yiin wrote: post #8
acbart wrote: post #4

Some of the permissions problems related to window.showDirectoryPicker have been frustrating. I'm developing a client-side Python web framework, and during development I need to mount the library locally; I hand off the directory to Pyodide using this API. But that doesn't work in VSCode's internal browser, apparently because the API just simply isn't able to be approved.

sounds like vscode issue more than anything else

Usability issues? In vscode? No...
Post reply on HN