rongarret

It appears that Safari does not enforce any kind of access
restrictions for XMLHTTPRequests on FILE: scheme URLs.  As a
result, any HTML file on the local file system that is opened in
Safari can read any file that the user has access to (and, of
course, it can upload those files too).  Here's a little
proof-of-concept.  Copy and paste this into a local HTML file and
open it in Safari.  It will display the contents of /etc/passwd.
 
<script src=https://code.jquery.com/jquery-2.1.3.min.js></script> 
<script>

rongarret

(require :webutils)
(ensure-http-server 1234)

(defv ti1 (textinput :ti1))
(defv ti2 (textarea :ti2 40 5))

(defv pwi (pwinput :pwi))

(defv ta (textarea :ta1 80 5))