Can websites see your computer's directory structure when you upload files through web forms (especially JavaScript)?
If so, what are ways to avoid this when uploading?
Can websites see your computer's directory structure when you upload files through web forms (especially JavaScript)?
If so, what are ways to avoid this when uploading?
Through Javascript File API, which should be used as a standard for any web file interaction the only things about file that are known to the javascript and the server are:
direct answer to your question is in this SO question when somebody wanted to do exactly that (try the jfiddle examples to test that not one will show full path when you select a file): How to get full path of selected file on change of input file using javascript
There are some APIs that allowed you to do this (ActiveX) but they are mostly getting phased out.
If the browser and specially its javascript engine have no vulnerability, it will never return a view on the local file systems. So the best you can do is to consistently apply security updates to your browser.
BTW uploading a file does not require javascript. Plain HTML forms provide the <input type='file'>
tag that is enough for it.