See my question and answer here: App Sandbox: document-scoped bookmark not resolving; not returning any error
I'm embedding collection-scoped bookmarks into my XML files.
Update
Given the specification that you have no control over the input XML format, the only way to get access for your app to a file specified in the XML is by having the user select that file or one of the file's parent directories in an NSOpenPanel
. If the XML contains multiple file references, you can have the user grant access to a directory that contains all of them.
There is no way around asking permission, since that would defeat the purpose of sandboxing. If your app could get around the user's direct permission, so could malware. Once given access, though, you can create a security-scoped bookmark to each file so you don't need to ask the user for permission multiple times.
Update 2
Answering the question in your comment, you can make the dialog easier for the user with the following:
[openPanel setMessage:@"Click 'OK' to allow access to files contained in the selected directory"];
[openPanel setDirectoryURL:[NSURL fileURLWithPath:pathFromTheXMLFile]];
Here's the documentation on NSSavePanel
(NSOpenPanel
inherits from it, and the properties above are defined there).