(Or that nothing is; I have not audited this code. But I vouched the parent comment to point out that browsers do offer this capability, and there's nothing facially suspicious in claiming to use it.)
Maybe I should not use the text ’upload’ to avoid the confusion