Full proper way to handle dynamic file loading

[sabercoy]

For my app (an image labeling and sorting app) I need to allow the user to select a directory and load all images into the webview.

• Current webview/browser functionality is to allow the user to select a specific file or multiple files to be loaded. Not an entire directory.
• You can use Go to pull up a file picker dialog to select and entire directory. However, the Go to JS bindings convert []byte to base64 string, making this very inefficient and slow.
• You can use the AssetServer for loading Dynamic Assets. This allows passing the blob to the webview without a base64 encoding step. However, it seems this is dangerous because having a "grab anything you want" file server sitting on someones system would allow other processes to use it, not just the frontend webview.

With all this in mind I have a few questions

• The Dynamic Assets docs say "It is recommended that you properly manage access to your filesystem." What exactly is expected to be done? Should a list of allowed directories be made for each OS in the Go code? Should there be some type of binding between the AssetServer and the webview (though I am not sure how one could do this) to ensure the AssetServer only serves the webview? There is the bespoke "wails://" protocol that, I suppose, would make it more difficult for another process to use (though theoretically it could be implemented given this is open source).
• If there is now 2 ways to bridge between Go and JS (RPC style and http server style), should there be 2? Given the http server is more flexible, should this be the focus to develop?

Thanks all, this is an awesome project.

[leaanthony]

It simply means, make sure you test that the file they are trying to access is what you want them to access. One example would be to limit it to certain directories, specific to the app. You need to take into account the potential that a malicious JS script could try and access files like $HOME/.ssh/id_rsa