Well, this is cool, but Safari allows for loading basically any file located on the filesystem. For instance, trying file:///etc/passwd results in file found but can not be opened by Safari.
Could you explain where you think the issue here is? Are you saying, as a user trying to upload, you could possibly (presumably accidentally) upload your passwd, or as a user of their site, you could somehow see their passwd file?
If it's the former, I think that's a 'vulnerability' with any site that has a file chooser.
If it's the latter, could you elaborate where and how you would do so? Perhaps you're saying you could load it through the simulator that's running on the actual computer/vm somewhere, but those simulator environment are sandboxes (afaik) so that you could only access files on within the simulator's context.
Agreed. This is an issue not just for Safari, but someone can upload a specially crafted app that browses the file system.
In this iteration we are using the OS permission system to isolate users. We are looking into more effective sandbox methods. Security is an ongoing process, and we always take an adversarial point of view when evaluating our system.
If it's the former, I think that's a 'vulnerability' with any site that has a file chooser.
If it's the latter, could you elaborate where and how you would do so? Perhaps you're saying you could load it through the simulator that's running on the actual computer/vm somewhere, but those simulator environment are sandboxes (afaik) so that you could only access files on within the simulator's context.