News for hackers. Stuff that matters.

A comment on The Native File System API allows web apps to save directly to files. Parent comment

Re:The Native File System API allows web apps to save direct... by yjftsjthsd-h on Wednesday September 09, 2020 @11:03AM (#24421798)
Not exactly what you're asking, but some thoughts:

* There is, for the moment, a flag to disable it, right?

* You could probably just have noscript/umatrix block JS outright (yes, I know this is overkill)

* Sibling comment is probably right in that Firefox is likely to not implement this immediately, if at all.

* You could also do it from the outside by sandboxing the whole browser; this is a somewhat poor mitigation (ex. leaves your Downloads directory wide open), but it could help.

[ Parent | on HN ]
Re:The Native File System API allows web apps to save direct... by SAI_Peregrinus on Wednesday September 09, 2020 @04:38PM (#24425662)
There's also Luminous[1], which can allow blocking individual JS events (eventAddListener and handleEvent calls). Something like that could also be extended to allow blocking of other API calls.

[1]https://gbaptista.github.io/luminous/doc/en-US/

[ Parent | on HN ]