Is it possible for a downloaded HTML file to get a directory listing of local directories?

I am asking from a security standpoint. I know a downloaded HTML file can send out files as long as it knows (or can guess) where they are stored.

A new Google Chrome change (can be tested by downloading the Chrome Canary Build) will depend on the OS to warn users about opening files like EXE files and oth开发者_运维技巧ers, but Windows does not warn about HTML files. It seems that with Chrome you cannot just get the html of an iframe of a directory. You can only do it for a single file.

Related: Are there files on a PC that are always same path/name and contain sensitive information?

Edit: I am deleting the related question. It seems that on the current version of Firefox you can only access files in the same directory and in IE you can only access files after disabling security and in Chrome only if it is accessing itself.

I know a downloaded HTML file can send out files as long as it knows (or can guess) where they are stored.

Nope: This is exactly why JavaScript can't access file contents, nor populate file upload fields, regardless of what context the page is running in.

A HTML page could open a directory listing in an iframe, but due to the same origin policy, it can't access its contents. Barring security holes, it is therefore safe to download and open a local HTML file.

i would say yes. a downloaded file can still have links to online source and content - unless you mean the file would be on a non-internet-connected machine...

Same origin policy says that you can only access content of iframe if it has the same protocol, same domain. Firefox and Chrome has additional hardening though. Still, there are some problems in IE and Opera. I was talking about it at my blog and you may read corresponding post. http://p0deje.blogspot.com/2010/09/opera-and-access-to-file-uri.html