What would the security implications be if JavaScript, in a browser, could perform a typical FileExists() operation with normal file paths (win and/or mac)? Something like Node's fs.existsSync(path)
but from JavaScript running in a browser's sandbox. Assuming the logged in, browser running user's normal file permissions are respected. I understand this is an information leakage problem.
My question is: what are the concrete consequences of this leakage that a semi-technical product manager would understand? Examples would be helpful. The JavaScript could be from a secure or insecure site, nothing else special, just the ability to test for the (Boolean) existence of files (not directories) with an absolute path.