Can JavaScript retrieve a file that is above the web root?

Question

Is it possible to make JavaScript retrieve a file that is above the web root?

function sendurl(url) {
if(document.images){ 
    (new Image()).src="../recieve_url.php?url="+url; 
} 
return true;
}

Answer 1

JavaScript is able to retrieve whatever the web server is capable of serving. By definition, web servers do not normally serve anything behind the main document root.

Answer 2

Whether or not such a directory traversal attack is possible has absolutely nothing to do with JavaScript (unless you run it server-side). HTTP requests initiated by JavaScript are no different than those initiated by you clicking on a link.

What it does depend on is the webserver and the server-side code that runs there - which often needs to be able to access files outside the web root and, if programmed carelessly, can often be tricked into doing directory traversal and returning the results.