不能使用脚本操作INPUTTYPE=File的value

最新推荐文章于 2022-06-10 17:05:28 发布

转载最新推荐文章于 2022-06-10 17:05:28 发布 · 3.3k 阅读

文章标签：

#file #脚本 #input #paradigms #scripting #behavior

项目专栏收录该内容

68 篇文章

订阅专栏

本文介绍了HTML中INPUT TYPE=File元素的安全限制，即无法通过脚本设置默认文件名。探讨了背后的原理并提供了一个使用ActiveX控件的解决方案。

PRB: Cannot Use Script to Manipulate INPUT TYPE=File Value

View products that this article applies to.

Article ID	:	266087
Last Review	:	May 11, 2006
Revision	:	3.0

This article was previously published under Q266087

SYMPTOMS

If you use an INPUT TYPE=File element in an HTML FORM element, you cannot set a file name programmatically, regardless if you use script or set the VALUE property of the INPUT element to a default value.

Back to the top

CAUSE

Because INPUT TYPE=File allows arbitrary files to be uploaded from a user's computer to a remote server, setting this field programmatically is considered a security risk and is not supported.

Back to the top

RESOLUTION

Uploading content from a user's computer without his or her knowledge is contrary to the security paradigms of Web development. The user should be informed whenever content is going to be transferred off their computer, and the user should be given every opportunity to control or cancel the operation.

If you require such functionality in your Web-based application, use an ActiveX control that is marked unsafe for scripting and/or unsafe for initialization. (The author of the control is responsible for telling users that the control is unsafe because, by definition, uploading files are unsafe. You can sign the control to ask users to trust your control.)

Back to the top

MORE INFORMATION

Steps to Reproduce Behavior

In any text editor, create the following HTML file, and save the file as TestFileSubmit.htm:

 <HTML>

<HEAD>
<TITLE>Automating Input=File Dialog Boxes</TITLE>

<SCRIPT>

function load() {
	frm1.file1.value = "C:/config.sys";
}

</SCRIPT>

</HEAD>

<BODY bgcolor="#ffffff">

<FORM name="frm1" action="/post.asp" METHOD="POST" 

ENCTYPE="multipart/form-data">
<INPUT type="File" name="file1" value="c:/boot.ini"></INPUT>
</FORM>


</BODY>

</HTML>

2. In Internet Explorer 4.x or 5.x, load the page. Notice that none of the values that are assigned to the INPUT TYPE=File element appear in the Edit box.

网络上有的一种解决办法，我试了，并不怎么好使。跟安全性有关系，如果安全性高，代码也是无法运行的。

<SCRIPT LANGUAGE="JavaScript">
document.getElementById('filename').focus();
var WshShell=new ActiveXObject("WScript.Shell")
WshShell.sendKeys("test.txt")
}