Chapter 4: Data Formats 143
PART I
Given that it is easy to figure out the format of a file upload, it might seem that it would
be simply a matter of creating the format to perform an Ajax-style file upload. It turns out
that isn’t true for a couple of reasons. First, script cannot be used to access the values of
<input type="file" /> elements and read the files on the user’s local system. Second,
even if this was possible, binary data cannot be handled in an XHR—it would have to be
encoded somehow, likely using base64 or similar encoding. Now, if you could somehow get
around those two issues with proper request formatting as previously discussed, it would
be possible to do an XHR-based file upload. You see this very dangerous and browser-
specific possibility in Firefox-based browsers.
The Firefox-specific file upload example can be found at http://ajaxref.com/ch4/
upload/xhrbased.html; we discuss a few of the more interesting bits here. First, before you
scream in frustration, to run the example you must change your security by flipping a
setting in your browser. To access your settings, type about:config in your address bar.
Toward the very bottom of the page make sure the value signed.applets.codebase_
principal_support is set to “true.” If you don’t do this, you will likely see a security error
complaining about denying UniversalXPConnect privileges or something similar. If you run
the example, you may also decide to remember any security decision you are prompted for,
but for safety’s sake we encourage you not to as a reminder to flip the setting back to its
normal value after you are done. Furthermore, given that you have already jumped through
some flaming hoops to make the example run, it is doubtful that your end users will do the
same, so proceed with caution.