feat: remove File.path (#42053)

docs/README.md

@@ -98,7 +98,6 @@ These individual tutorials expand on topics discussed in the guide above.
 
 ### Custom DOM Elements:
 
-* [`File` Object](api/file-object.md)
 * [`<webview>` Tag](api/webview-tag.md)
 * [`window.open` Function](api/window-open.md)
 

docs/api/file-object.md

@@ -1,36 +0,0 @@
-# `File` Object
-
-> Use the HTML5 `File` API to work natively with files on the filesystem.
-
-> **Warning**
-> The `path` property that Electron adds to the `File` interface is deprecated
-> and **will** be removed in a future Electron release.  We recommend you
-> use `webUtils.getPathForFile` instead.
-
-The DOM's File interface provides abstraction around native files in order to
-let users work on native files directly with the HTML5 file API. Electron has
-added a `path` attribute to the `File` interface which exposes the file's real
-path on filesystem.
-
-Example of getting a real path from a dragged-onto-the-app file:
-
-```html
-<div id="holder">
-  Drag your file here
-</div>
-
-<script>
-  document.addEventListener('drop', (e) => {
-    e.preventDefault();
-    e.stopPropagation();
-
-    for (const f of e.dataTransfer.files) {
-      console.log('File(s) you dragged here: ', f.path)
-    }
-  });
-  document.addEventListener('dragover', (e) => {
-    e.preventDefault();
-    e.stopPropagation();
-  });
-</script>
-```

docs/breaking-changes.md

@@ -12,6 +12,38 @@ This document uses the following convention to categorize breaking changes:
 * **Deprecated:** An API was marked as deprecated. The API will continue to function, but will emit a deprecation warning, and will be removed in a future release.
 * **Removed:** An API or feature was removed, and is no longer supported by Electron.
 
+## Planned Breaking API Changes (32.0)
+
+### Removed: `File.path`
+
+The nonstandard `path` property of the Web `File` object was added in an early version of Electron as a convenience method for working with native files when doing everything in the renderer was more common. However, it represents a deviation from the standard and poses a minor security risk as well, so beginning in Electron 32.0 it has been removed in favor of the [`webUtils.getPathForFile`](api/web-utils.md#webutilsgetpathforfilefile) method.
+
+```js
+// Before (renderer)
+
+const file = document.querySelector('input[type=file]')
+alert(`Uploaded file path was: ${file.path}`)
+```
+
+```js
+// After (renderer)
+
+const file = document.querySelector('input[type=file]')
+electron.showFilePath(file)
+
+// (preload)
+const { contextBridge, webUtils } = require('electron')
+
+contextBridge.exposeInMainWorld('electron', {
+  showFilePath (file) {
+    // It's best not to expose the full file path to the web content if
+    // possible.
+    const path = webUtils.getPathForFile(file)
+    alert(`Uploaded file path was: ${path}`)
+  }
+})
+```
+
 ## Planned Breaking API Changes (31.0)
 
 ### Removed: `WebSQL` support

filenames.auto.gni

@@ -22,7 +22,6 @@ auto_filenames = {
     "docs/api/download-item.md",
     "docs/api/environment-variables.md",
     "docs/api/extensions.md",
-    "docs/api/file-object.md",
     "docs/api/global-shortcut.md",
     "docs/api/in-app-purchase.md",
     "docs/api/incoming-message.md",

patches/chromium/.patches

@@ -1,6 +1,5 @@
 build_gn.patch
 accelerator.patch
-blink_file_path.patch
 blink_local_frame.patch
 can_create_window.patch
 disable_hidden.patch

patches/chromium/blink_file_path.patch

@@ -1,34 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Cheng Zhao <zcbenz@gmail.com>
-Date: Thu, 20 Sep 2018 17:45:00 -0700
-Subject: blink_file_path.patch
-
-This is used by editors to obtain the filesystem path from a dragged file. See
-documentation at https://electronjs.org/docs/api/file-object
-
-diff --git a/third_party/blink/renderer/core/fileapi/file.h b/third_party/blink/renderer/core/fileapi/file.h
-index bb5967988cb69d24af94337b67379f1200a2508b..a935500bbef25a73840931648f3e65e70fc098f4 100644
---- a/third_party/blink/renderer/core/fileapi/file.h
-+++ b/third_party/blink/renderer/core/fileapi/file.h
-@@ -220,6 +220,9 @@ class CORE_EXPORT File final : public Blob {
-   }
-   const String& name() const { return name_; }
- 
-+  // Getter for the path IDL attribute.
-+  const String& path() const { return GetPath(); }
-+
-   // Getter for the lastModified IDL attribute,
-   // http://dev.w3.org/2006/webapi/FileAPI/#file-attrs
-   // This method calls CaptureSnapshotIfNeeded, and thus can involve synchronous
-diff --git a/third_party/blink/renderer/core/fileapi/file.idl b/third_party/blink/renderer/core/fileapi/file.idl
-index 4339a27e87c12279b2a2f08a7c3d181e7265a986..6aebb1ba4f74a4cfdc546fe5903032f4bc23dd30 100644
---- a/third_party/blink/renderer/core/fileapi/file.idl
-+++ b/third_party/blink/renderer/core/fileapi/file.idl
-@@ -31,6 +31,7 @@
- ] interface File : Blob {
-     [CallWith=ExecutionContext] constructor(sequence<BlobPart> fileBits, USVString fileName, optional FilePropertyBag options = {});
-     readonly attribute DOMString name;
-+    readonly attribute DOMString path;
-     readonly attribute long long lastModified;
- 
-     // Non-standard APIs

spec/ts-smoke/electron/renderer.ts

@@ -121,32 +121,6 @@ function getUserMediaError (error: Error) {
   console.log('getUserMediaError', error);
 }
 
-// File object
-// https://github.com/electron/electron/blob/main/docs/api/file-object.md
-
-/*
-<div id="holder">
-  Drag your file here
-</div>
-*/
-
-const holder = document.getElementById('holder');
-
-holder.ondragover = function () {
-  return false;
-};
-
-holder.ondragleave = holder.ondragend = function () {
-  return false;
-};
-
-holder.ondrop = function (e) {
-  e.preventDefault();
-  const file = e.dataTransfer.files[0];
-  console.log('File you dragged here is', file.path);
-  return false;
-};
-
 // nativeImage
 // https://github.com/electron/electron/blob/main/docs/api/native-image.md