Steps to Reproduce

upload text files using the upload button/menuitem or dropupload below

<button upload="true,native" label="upload"
			onUpload='Clients.log(event.media.name + ", binary=" + event.media.binary);'/>
	<menubar>
		<menuitem upload="true,native" label="upload"
				  onUpload='Clients.log(event.media.name + ", binary=" + event.media.binary);'/>
	</menubar>

	DropUpload
	<dropupload native="true" width="200px" height="100px" style="border: 1px solid red"
				onUpload='Clients.log(event.media.name + ", binary=" + event.media.binary);'/>

Current Result

button and menuitem ignore the native-flag, resulting in uploaded string data
dropupload correctly uploads the textfile into a byte array

Expected Result

native upload should always result in binary upload into a byte array

Debug Info

the upload URLs for button and menuitem have a value or "undefined" for the native flag
http://localhost:8086/zksupport86/zkau/dropupload?uuid=x7JQ0&dtid=z_wsf&native=undefined
http://localhost:8086/zksupport86/zkau/dropupload?uuid=x7JQ2&dtid=z_wsf&native=undefined

dropupload keeps the flag as expected
http://localhost:8086/zksupport86/zkau/dropupload?uuid=x7JQ4&dtid=z_wsf&native=true

Root Cause

the upload URL is initially assembled correctly
https://github.com/zkoss/zk/blob/v8.6.1/zul/src/archive/web/js/zul/Upload.js#L44

and later created again reading the native flag from an uninitialized attribute _native (for dropupload this exists, for button and menuitem it doesn't)
https://github.com/zkoss/zk/blob/v8.6.1/zk/src/archive/web/js/zk/uploadUtils.js#L21

As a side thought... this flag (native or not) is already known at server side so it doesn't need to be sent with the request at all.
It can be retrieved from the target component directly. (The client side should not have the "right" to override server side configured behavior)

Workaround

By setting the client side flag "w:_native" manually it is passed correctly to the server

<zk xmlns:w="client">
	<button upload="true,native" label="upload (workaround)"
			w:_native="true"
			onUpload='Clients.log(event.media.name + ", binary=" + event.media.binary);'/>
	<menubar>
		<menuitem upload="true,native" label="upload (workaround)"
				  w:_native="true"
				  onUpload='Clients.log(event.media.name + ", binary=" + event.media.binary);'/>
	</menubar>
</zk>