Allow "downloading" (exporting?) of files

[iffy]

Your document may want to give the user a CSV or JSON file (or image or whatever). Provide a secure way for documents to offer up files to be saved.

Security considerations I can currently think of:

• Spamming the "Save" dialog is annoying and could be a DOS
• A document could provide a malicious executable for download/running. I'm not sure how the OS will handle this. For instance, macOS (and Windows?) will warn you before executing an executable downloaded from the Internet. The same warnings may not happen for files exported from an LHTML doc.
• A malicious document might create a massive file and consume disk space

[iffy]

I think that perhaps (on macOS at least) I can twiddle the extended attribute bits on any file to make it at least warn the user about potentially malicious files.

[iffy]

For Windows: http://woshub.com/how-windows-determines-that-the-file-has-been-downloaded-from-the-internet/

So that leaves Linux...

[iffy]

• macOS: https://www.npmjs.com/package/fs-xattr
• Windows: https://github.com/nodejs/node-v0.x-archive/issues/6344
• Linux: ???