From 0f5188d0c5fb22ebccfafc88f02a196e9d6c9bbd Mon Sep 17 00:00:00 2001
From: beeps <hi+github@berly.kim>
Date: Thu, 12 Sep 2024 16:14:00 +0100
Subject: [PATCH] Remove value parameter from file upload component

For security reasons, file inputs cannot have the value property set to anything except for an empty string. This parameter has thus never actually worked for anything other than to output a non-functioning HTML attribute. We can probably get rid of it.
---
 .../src/govuk/components/file-upload/file-upload.yaml | 11 -----------
 .../src/govuk/components/file-upload/template.njk     |  1 -
 .../src/govuk/components/file-upload/template.test.js |  7 -------
 3 files changed, 19 deletions(-)

diff --git a/packages/govuk-frontend/src/govuk/components/file-upload/file-upload.yaml b/packages/govuk-frontend/src/govuk/components/file-upload/file-upload.yaml
index 6506fde6eb..b0497ef7fd 100644
--- a/packages/govuk-frontend/src/govuk/components/file-upload/file-upload.yaml
+++ b/packages/govuk-frontend/src/govuk/components/file-upload/file-upload.yaml
@@ -7,10 +7,6 @@ params:
     type: string
     required: true
     description: The ID of the input.
-  - name: value
-    type: string
-    required: false
-    description: Optional initial value of the input.
   - name: disabled
     type: boolean
     required: false
@@ -107,13 +103,6 @@ examples:
         text: Your photo may be in your Pictures, Photos, Downloads or Desktop folder. Or in an app like iPhoto.
       errorMessage:
         text: Error message goes here
-  - name: with value
-    options:
-      id: file-upload-4
-      name: file-upload-4
-      value: C:\fakepath\myphoto.jpg
-      label:
-        text: Upload a photo
   - name: with label as page heading
     options:
       id: file-upload-1
diff --git a/packages/govuk-frontend/src/govuk/components/file-upload/template.njk b/packages/govuk-frontend/src/govuk/components/file-upload/template.njk
index a3b11c7b90..61db82e1ad 100644
--- a/packages/govuk-frontend/src/govuk/components/file-upload/template.njk
+++ b/packages/govuk-frontend/src/govuk/components/file-upload/template.njk
@@ -43,7 +43,6 @@
   {{ params.formGroup.beforeInput.html | safe | trim | indent(2) if params.formGroup.beforeInput.html else params.formGroup.beforeInput.text }}
 {% endif %}
   <input class="govuk-file-upload {%- if params.classes %} {{ params.classes }}{% endif %} {%- if params.errorMessage %} govuk-file-upload--error{% endif %}" id="{{ params.id }}" name="{{ params.name }}" type="file"
-  {%- if params.value %} value="{{ params.value }}"{% endif %}
   {%- if params.disabled %} disabled{% endif %}
   {%- if describedBy %} aria-describedby="{{ describedBy }}"{% endif %}
   {{- govukAttributes(params.attributes) }}>
diff --git a/packages/govuk-frontend/src/govuk/components/file-upload/template.test.js b/packages/govuk-frontend/src/govuk/components/file-upload/template.test.js
index 0aaee979a9..0fd7b7df97 100644
--- a/packages/govuk-frontend/src/govuk/components/file-upload/template.test.js
+++ b/packages/govuk-frontend/src/govuk/components/file-upload/template.test.js
@@ -45,13 +45,6 @@ describe('File upload', () => {
       ).toBeTruthy()
     })
 
-    it('renders with value', () => {
-      const $ = render('file-upload', examples['with value'])
-
-      const $component = $('.govuk-file-upload')
-      expect($component.val()).toBe('C:\\fakepath\\myphoto.jpg')
-    })
-
     it('renders with aria-describedby', () => {
       const $ = render('file-upload', examples['with describedBy'])