A XAML browser application (XBAP) running in partial trust can safely upload files from a client machine.
<Page x:Class="SafeFileUploadPartialTrustSample.HomePage" xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" Title="HomePage" xmlns:dialogs="clr-namespace:Microsoft.Win32;assembly=PresentationFramework"> <StackPanel> <Button Name="uploadButton" Click="uploadButton_Click" Width="100">Upload Image...</Button> <Image Name="viewImage" Width="500" Height="300"></Image> <Label Name="nameLabel"></Label> </StackPanel> </Page> //File:Window.xaml.vb Imports System Imports System.IO Imports System.Windows Imports System.Windows.Controls Imports System.Windows.Media Imports System.Windows.Media.Imaging Imports System.Windows.Navigation Imports Microsoft.Win32 Namespace SafeFileUploadPartialTrustSample Public Partial Class HomePage Inherits Page Implements IProvideCustomContentState Public Sub New() InitializeComponent() End Sub Private Sub uploadButton_Click(sender As Object, e As RoutedEventArgs) Dim dlg As New OpenFileDialog() dlg.Filter = "Image Files(*.BMP;*.JPG;*.GIF)|*.BMP;*.JPG;*.GIF|All files (*.*)|*.*" If dlg.ShowDialog() = True Then If Me.viewImage.Source IsNot Nothing Then Dim iccs As New ImageCustomContentState(Me.viewImage.Source, DirectCast(Me.nameLabel.Content, String)) Me.NavigationService.AddBackEntry(iccs) End If Using stream As Stream = dlg.OpenFile() Dim bitmapDecoder__1 As BitmapDecoder = BitmapDecoder.Create(stream, BitmapCreateOptions.PreservePixelFormat, BitmapCacheOption.OnLoad) Me.viewImage.Source = bitmapDecoder__1.Frames(0) Me.nameLabel.Content = dlg.SafeFileName End Using End If End Sub Public Function GetContentState() As CustomContentState Implements IProvideCustomContentState.GetContentState Return New ImageCustomContentState(Me.viewImage.Source, DirectCast(Me.nameLabel.Content, String)) End Function End Class <Serializable> _ Public Class ImageCustomContentState Inherits CustomContentState Private imageSource As ImageSource Private filename As String Public Sub New(imageSource As ImageSource, filename As String) Me.imageSource = imageSource Me.filename = filename End Sub Public Overrides ReadOnly Property JournalEntryName() As String Get Return Me.filename End Get End Property Public Overrides Sub Replay(navigationService As NavigationService, mode As NavigationMode) Dim homePage As HomePage = DirectCast(navigationService.Content, HomePage) homePage.viewImage.Source = Me.imageSource homePage.nameLabel.Content = Me.filename End Sub End Class End Namespace