3

I'm not sure if the place to ask this question so feel free to move my question elsewhere or closed it.
I have been told that Javascript can write and read from disk only when an explicit event like drag & drop happen on the browser and gave it a handle to a file.

In the case of Mega(ex upload) when you click download you are directly saving a file to disk without being asked to save it or installing any extension your browser.
Is it a feature of Javascript or HTML 5 because in my opinion it means a terrible security issue in this case.

Edit 1: So my question is, how do Mega manage to write on disk without showing you the Save to dialog of your browser popped up and self determining where to put the file

Andy
  • 49,085
  • 60
  • 166
  • 233
Kiwy
  • 340
  • 2
  • 10
  • 43
  • 2
    You mean there is no `Save to`-dialog popping up? How do they know where to save it then? Since I haven't used Mega, it would be nice if you could be more detailed. – Bergi Jan 09 '14 at 12:21
  • 1
    What browser do you use? In my default installation of Google Chrome, I never get a "Save as" dialog when clicking download links for files. It automatically saves the file to my "Downloads" directory. If this is how your browser works, @johnnycardy's answer below is what "does the magic". – zrvan Feb 10 '14 at 10:27
  • @zrvan but still using mega will not wshow the download in the download list and the download occure from the download page to your drive directly without using the browser – Kiwy Feb 10 '14 at 10:28
  • 1
    Refer to http://stackoverflow.com/questions/15994554/download-files-like-mega-co-nz for a detailed description on how it works. – Kariem Oct 29 '14 at 14:36

3 Answers3

12

The question is somewhat vague, to answer properly maybe we need more information about your system and browser vendor/version. Mega uses some really cool stuff to handle downloads and files.

They use, depending of the client environment:

  • Filesystem API (Chrome / Firefox Extension polyfill);
  • Adobe Flash SWF Filewriter (fallback for old browsers);
  • BlobBuilder (IE10/IE11);
  • MEGA Firefox Extension (deprecated);
  • Arraybuffer/Blob Memory Based;
  • MediaSource (experimental streaming solution);
  • IndexedDB blob based (Firefox 20+).

With all these methodologies, download directly without user intervention/authorization will rely on the browser compatibility. I am using Firefox on Linux, when I choose a file from Mega and click to download, a dialog box shows up so, in matter of effect, I have to authorize the download. But if you look to this screnshot, in the 'from' field you will see the word 'blob', thats a sign of a Blob object from the File API W3C Specification.

You can see a Blob API utilization example in this fiddle and inspecting Mega's source code (case 4: Arraybuffer/Blob Memory Based, lines 15, 293, 324, 802).

window.URL = window.URL || window.webkitURL;

var blobExample = new Blob(['\
<!doctype html>\n\
<html>\n\
<body>Hello from Blob file!</body>\n\
</html>'], {type: 'text/html'});

var blobLink  = document.createElement('link');
blobLink.rel  = 'html';
blobLink.href = window.URL.createObjectURL(blobExample);
document.body.appendChild(blobLink);

var anchor = document.createElement('a');
anchor.href = window.URL.createObjectURL(blobExample);
anchor.download = 'blob-example.html';
anchor.textContent = 'Download the binary large object';
document.body.appendChild(anchor);

=)

brunoric
  • 373
  • 2
  • 7
  • In fact the addons for mega was install on all the different firefox I used... so that was the probleme, but still that blob feature is a bit strange in my opinion – Kiwy Feb 14 '14 at 11:17
  • also, Mega uses XMLHttpRequest.onprogress event to store chunks in Blob – Pedro Sanção Feb 22 '19 at 12:19
2

Strange... I'm using Mega on daily basis and it always shows the Save to dialog. Doesn't this depends on your browser settings?

I'm not having enough reputation to add a comment, so I had to post this as an answer, sorry for that.

Luboš Staráček
  • 911
  • 8
  • 15
  • 1
    @DanFromGermany I'm not settings any automatic download for any type of file, I ask my browser to always ask where it should put a file. No fact is I have always use mega with the addons without remembering downloading it. – Kiwy Feb 14 '14 at 11:14
  • 1
    This is nothing to do with browser settings. Every other file I've ever downloaded in Firefox has prompted me with a 'save as' box. Mega doesn't show the prompt until the download is complete. – jbrown Aug 17 '19 at 08:23
-1

It's just a matter of sending the right headers in the response - so the browser knows to save instead of open. It's nothing to do with javascript or HTML5.

For example, in PHP:

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($file).'"'); 
header('Content-Transfer-Encoding: binary');
header('Connection: Keep-Alive');
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
header('Content-Length: ' . filesize($file));

I don't know what server-side technology Mega uses but this is the basic premise.

Edit: in response to your edited question about why the 'Save As' dialog does not appear, well, that's a browser setting. Chrome, for example, will by default save to your Downloads folder (on Windows) without prompting.

johnnycardy
  • 3,049
  • 1
  • 17
  • 27
  • how Php could write to your disk without you being told of ? do you imagine what does it imply ? it's amjor bug of every browser if what you're saying is true – Kiwy Feb 10 '14 at 10:19
  • 5
    Mega is using JavaScript to download the file into memory first, because it gets decrypted from there using private key (stored in JS aswell). Nothing to do with PHP headers. – Daniel W. Feb 10 '14 at 10:33
  • 1
    @Kiwy PHP can't write to your disk (unless running on a server on your machine). It's your browser (e.g. Chrome) that downloads without a dialogue. In Chrome see Settings > Show Advanced Settings > Content Settings > Automatic Downloads. – Josh Harrison Feb 10 '14 at 12:13
  • Nothing to do with response headers. That'd be quite the security hole wouldn't it? And it's nothing to do with browser settings since it prompts when the download is complete instead of when it's initiated like every other site. – jbrown Aug 17 '19 at 08:24