[Feature Request]: Support FileTransfer portal (secure drag and drop between sandboxed Linux apps)

[vchernin]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a feature request that matches the one I want to file, without success.

Problem Description

Electron should support the FileTransfer portal as it will let users drag & drop and copy-paste files/folders securely to sandboxed Linux apps.

Flatpak and other sandboxed Linux packages (eg. Snap) use XDG Desktop Portal to securely communicate between the sandbox and the host. This is crucial for sandboxed apps, as otherwise apps need to be given unilateral access to the host, notably file system access.

XDG Desktop Portal's FileChooser portal was recently implemented in Electron: #19159. This means a sandboxed app could have no unilateral file system access, but still open the file picker, select, and "upload" a file/folder to an app without letting that sandboxed app know about anything other than the picked file/folder.

However, the FileChooser portal does not cover dragging & dropping a file into an Electron app (or vice versa) or secure copy-paste. The FileTransfer portal is what is needed for drag & drop and copy-paste to work securely between the host and the sandbox.

Proposed Solution

Implement support for the FileTranfer portal in Electron. This might be best done in Chromium and then reused in Electron. The libportal library could eventually be used here but it does not yet support FileTransfer.

The FileTranfer portal can be used by both sandboxed and non sandboxed apps, as discussed here: flatpak/libportal#33

Alternatives Considered

Workaround by giving sandboxed apps unilateral permission to access the host's filesystem. This is the status quo today for many apps, and is very much an anti-goal for sandboxed apps.

Additional Information

For this implementation to be useful, other apps are also required to support the FileTransfer portal. So if a user drags a file from a file manager to an Electron app (with FileTransfer implemented), that file manager must support FileTransfer too, otherwise it will still not work.

As of 2021-08-19, the only other toolkit/framework that supports the FileTransfer portal is GTK4.

Bugs for other toolkits/frameworks:
GTK 3, QT

[Mart-Bogdan]

By the way, it just have being implemented in GTK3 two months ago https://gitlab.gnome.org/GNOME/gtk/-/commit/9f81db139d03a1b7d9bdac298fb6424a14d645cb

This commit can be used as reference.

[threema-danilo]

This is a major usability issue right now. Thanks to the file system portal, opening a file works even if the file system permission is very limited. However, drag & drop is broken in that case: The application gets the file system path on the host system, but permission to that file is denied.

From a usability perspective, it would be best to just default to --filesystem=host. However, from a security perspective, that's not a great idea. A file transfer portal implementation should resolve this issue.