Allow folks to enable File System API with a Flag

[pes10k]

could i bug you to change the Native File System API feature from “off with no way to enable” (what it is currently) to “disabled by default but enable-able with a flag”?

[pikilon]

Yeah or even as a site config feature

[mkarolin]

Test plan:

1. Start Brave
2. Navigate to https://brave.com
3. Right-click and select Inspect to open DevTools
4. In the DevTools, select Console tab
5. Paste the following code in the Console window: self.showOpenFilePicker()

Expected result:
Uncaught TypeError: self.showOpenFilePicker is not a function

6. Navigate to brave://flags
7. In the search box type file-system-access-api

Expected result:
File System Access API item is shown

8. Change the File System API item's status to Enabled
9. Click on the Relaunch button
10. Once the browser restarts, repeat steps 2 - 5

Expected result:
Open file picker dialog is shown

[mkarolin]

Note: Removed OS/Andrdoid label as File System Access API is not available for Android yet. See: https://bugs.chromium.org/p/chromium/issues/detail?id=1011535

[stephendonner]

Verified PASSED using

Brave	1.33.51 Chromium: 95.0.4638.69 (Official Build) nightly (x86_64)
Revision	6a1600ed572fedecd573b6c2b90a22fe6392a410-refs/branch-heads/4638@{#984}
OS	macOS Version 11.6.1 (Build 20G224)

Steps:

1. Start Brave
2. Navigate to https://brave.com
3. Right-click and select Inspect to open DevTools
4. In the DevTools, select Console tab
5. Paste the following code in the Console window: self.showOpenFilePicker()

Expected result:
Uncaught TypeError: self.showOpenFilePicker is not a function

6. Navigate to brave://flags
7. In the search box type file-system-access-api

Expected result:
File System Access API item is shown

example	example

8. Change the File System API item's status to Enabled
9. Click on the Relaunch button
10. Once the browser restarts, repeat steps 2 - 5

Expected result:
Open file picker dialog is shown

[jimmywarting]

Borrowing this thread a bit. but may i ask what the reasoning behind having it disabled by default?

[pes10k]

bc users giving websites direct access to their local disk (even behind a permission) is a huge footgun that is very likely to be abused and harm some users.

We're interested (resources permitting) on supporting the origin filesystem (file system like API but not tied to the actual file system), but do not plan to enable the over all File System API

[jimmywarting]

Websites can still obtain access to user-selected folders or files through actions such as dragging and dropping items. Although write access may not be granted, it is still possible for websites to retrieve files and folders using the slightly worse option: <input type="file" webkitdirectory multiple /> feature. Additionally, with the capabilities of drag and drop and DataTransfer, websites can repeatedly read files if changes occur.

Considering that file input and drag and drop already allow for this functionality, I fail to see why showOpenDirectory and showOpenFilePicker would be deemed dangerous. As for saving files, it is possible to create a blob URL and initiate a click on an <a href="blob:url" download="name.txt"> element or utilize resources like StreamSaver.js for saving large files with streams. Consequently, I don't understand why the existence of showSaveFilePicker should be questioned when alternative methods for saving files already exist.

So I fail to see a compelling reason for why the File System Access feature cannot be deemed trustworthy, or at least certain parts of it. If the concern lies in granting write access to specific areas, a potential solution could be to restrict access to read-only permissions throughout the entire session and revoked once the session ends. Consequently, when calling handle.requestPermission({ mode }) and checking the state of queryPermission(), instead of receiving a prompt state, the response could instead be set to denied.

For example, if a folder is dragged and dropped, and a file system handle is obtained using DataTransferItem.prototype.getAsFileSystemHandle, the risk would not be significantly greater than using DataTransferItem.prototype.webkitGetAsEntry with read-only access, where write access cannot be granted.
And as such i don't see why showOpen*Picker can exist with just only read access

[guest271314]

bc users giving websites direct access to their local disk (even behind a permission) is a huge footgun that is very likely to be abused and harm some users.

When users write to localStorage or private origin filesystem that data is written to the users' local disk, and is accessible, readable, see How to write into a file (in user directory) using JavaScript?.

What about cookies?

I don't get the top-down, hierarchical organizational idea that users are not capable of making their own decisions on their own machines about what they enable or disable.

If you don't want to write files to the local filesystem don't do so on your own machine. What you decide to do on your own machine does not translate to all users in the known universe must do as you say and do on their own machines.

[guest271314]

bc users giving websites direct access to their local disk (even behind a permission) is a huge footgun that is very likely to be abused and harm some users.

const a = document.createElement("a");
a.download = "direct_access_to_local_filesystem.txt";
a.href = "data:text/plain,direct access to their local disk";
a.click();