In the last few weeks I work on a project about digitally signing Web forms. I need to develop a Java applet that signs Web forms (all form fields along with the attachments). The way we want to implement this is to use signed applet (running in the client Web browsers without any security restrictions) that collects all forms fields and their values, save them into a XML document, digitall signs the XML (using a private kay comming from a PKCS#12 keystore or PKCS#11 smart card) and finally produces PKCS#7 SignedData object (containing the XML, the signature and the certificate and the entire certification chain of the signer).

Not All Browsers Support Reading the Full File Path from <input type=”file”>

All runs well except that the applet should read the contents of all files that are selected for uploading along with the Web form (in order to include their content in the XML). Thus the applet needs the exact location in the file system for each uploaded file. The usual solution for this problem is to get the full file path and file name of the selected for uploading files from the Web form (e.g. document.forms[0].fileToUpload.value).

This works well in the following browsers:

• Internet Explorer 6, Internet Explorer 7
• Mozilla Firefox 1.5, Mozilla Firefox 2.0
• Safari 2, Safari 3

In all of the above Web browsers whn you acces the “value” property of the file upload control (<input type=”file”>) you get the file name along with the full path to the selected file (e.g. “C:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma”).

In some browsers due to privacy policy only the file name (without the path) is returned (e.g. “New Stories (Highway Blues).wma”). I found that the following browsers do not allow accessing the full path of the uploaded files:

• Forefox 3
• Opera 9

Firefox 3 Supports Reading File Contents from JavaScript

I found a way to read the file contents from JavaScript in Firefox 3. It is pretty easy:

fileForUpload = document.forms[0].fileForUpload;
fileContents = fileForUpload.files.item(0).getAsBinary();
alert(fileContents);

This opens a way to workaround the problem in FF3 because my applet can read the file contents of the selected for uploading files directly from the Web browser (instead of taking the full file path and reading the file contents in Java).

See an example of how this works: Reading file contents in Firefox 3 – Example.