Add mechanism to allow strict file filtering in a file input

[lukewarlow]

It would be nice if a new attribute (or other mechanism) was added to the file input similar to the excludeAcceptAllOption from the proposed File System Access API.

This would enable the benefits of that option, without being bundled into the rest of the API which is controversial and unlikely to be implemented in some engines (at least not soon).

This option has the benefit of a better UX as a user can't select an invalid file type to then have (at best) the application tell them it's not valid, and at worst the action not work but in a completely opaque way confusing the user.

Alternatively, the spec wording for the accept attribute could be changed like below.

"User agents should must prevent the user from selecting files that are not accepted by one (or more) of these tokens."

Safari already doesn't have an "All Files" option with its file picker, so potentially other browsers could follow suit.

This second approach would also have the benefit of applying to all web content without requiring a new attribute be added to the markup. But perhaps has backwards compatibility issues I've not thought of (doubtful given Safari's current behaviour).

[pshaughn]

I don't think this can really be defined as a "must", since the user agent can't always be sure what type a file on the filesystem is. It's possible to want to upload a file that's in a format the browser doesn't understand but the server will understand. I think local file picking concepts are too deep into platform-specific UI functionality to be stated as firm requirements.

[lukewarlow]

In that case a new attribute that says for my use case I know these are well understood types and as such should be strictly enforced (read no "All files" option) would be nice.

[annevk]

We cannot require things from UI, should is the best you are going to get.

[lukewarlow]

Increasing the likelihood of said request being followed is what I'm requesting. Of course you would still need server validation and what not. excludeAcceptAllOption from the File System Access API provides more guarantees. That but on the file input is what I am requesting. If that's unlikely to happen then that's fine. But I just felt like it was worth requesting.

[pshaughn]

I'll agree that, if browsers do end up implementing excludeAcceptAllOption as a hard UI restriction, then an attribute to do likewise on a file form input makes sense as something to also implement, so people can get that behavior on a form field without going through a layer of scripting. Currently, that part of the File System Access API appears to exist only as a desktop Chromium feature, without any other implementations to converge on how it should behave.