A XAML browser application (XBAP) running in partial trust can safely upload files from a client machine.


   
  


<Page x:Class="SafeFileUploadPartialTrustSample.HomePage"
    xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
    xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
    Title="HomePage"
  xmlns:dialogs="clr-namespace:Microsoft.Win32;assembly=PresentationFramework">
    <StackPanel>
    <Button Name="uploadButton" Click="uploadButton_Click" Width="100">Upload Image...</Button>
    <Image Name="viewImage" Width="500" Height="300"></Image>
    <Label Name="nameLabel"></Label>
    
    </StackPanel>
</Page>
//File:Window.xaml.cs
using System;
using System.IO;
using System.Windows;
using System.Windows.Controls;
using System.Windows.Media;
using System.Windows.Media.Imaging;
using System.Windows.Navigation;
using Microsoft.Win32;

namespace SafeFileUploadPartialTrustSample {
    public partial class HomePage : Page, IProvideCustomContentState {
        public HomePage() {
            InitializeComponent();
        }

        void uploadButton_Click(object sender, RoutedEventArgs e) {
            OpenFileDialog dlg = new OpenFileDialog();
            dlg.Filter = "Image Files(*.BMP;*.JPG;*.GIF)|*.BMP;*.JPG;*.GIF|All files (*.*)|*.*";

            if (dlg.ShowDialog() == true) {
                if (this.viewImage.Source != null) {
                    ImageCustomContentState iccs = new ImageCustomContentState(this.viewImage.Source, (string)this.nameLabel.Content);
                    this.NavigationService.AddBackEntry(iccs);
                }
                using (Stream stream = dlg.OpenFile()) {
                    BitmapDecoder bitmapDecoder = BitmapDecoder.Create(stream, BitmapCreateOptions.PreservePixelFormat, BitmapCacheOption.OnLoad);
                    this.viewImage.Source = bitmapDecoder.Frames[0];
                    this.nameLabel.Content = dlg.SafeFileName;
                }
            }
        }
        public CustomContentState GetContentState() {
            return new ImageCustomContentState(this.viewImage.Source, (string)this.nameLabel.Content);
        }
    }
    [Serializable]
    public class ImageCustomContentState : CustomContentState
    {

        ImageSource imageSource;
        string filename;

        public ImageCustomContentState(ImageSource imageSource, string filename)
        {
            this.imageSource = imageSource;
            this.filename = filename;
        }

        public override string JournalEntryName
        {
            get { return this.filename; }
        }

        public override void Replay(NavigationService navigationService, NavigationMode mode)
        {
            HomePage homePage = (HomePage)navigationService.Content;
            homePage.viewImage.Source = this.imageSource;
            homePage.nameLabel.Content = this.filename;
        }
    }
}