Using external storage from Firebase library

[sebadiaz-arg]

Hi!
We're developing an mobile app with React Native. Our Cybersecurity team have asked us a reason to allow this library to access into External Storage of the users phone. We've watching into the code and we saw that into this file (see the link after this) it gets the external storage location into the KEY_EXT_STORAGE_DIRECTORY variable:

react-native-firebase/packages/app/android/src/reactnative/java/io/invertase/firebase/utils/ReactNativeFirebaseUtilsModule.java

Line 182 in 8efda50

constants.put(KEY_EXT_STORAGE_DIRECTORY, externalStorageDirectory.getAbsolutePath());

So, the question is: why Firebase needs to use the External Storage of the phone?
Thanks in advance!
Sebastian.

[mikehardy]

This is a convenience method, that has existed forever and it would be a breaking change for us to remove it.
All it does is get the path, and it's perfectly fine if the directory does not exist or the app has no permission for it.
Unless you access the path, and use it somehow, you are still not using external storage, as getting a path from the system using a public API does not equate to use of the path

In the v12 release I specifically removed permission from the library in order to allow consumers to manage their use of external storage directly https://github.com/invertase/react-native-firebase/blob/main/CHANGELOG.md#1200-2021-05-19

[nahugonza11]

Hi! @mikehardy , Is there any risk or something to consider when removing external storage?

[mikehardy]

This falls firmly in the 'try it and see' category of changes. If you are using the feature, if course you will have problems. If you are not, it should be fine. It's fine in my apps

[Agorus]

get the path where the application is installed? What do you need that route for?

[sebadiaz-arg]

Thanks @mikehardy, that answer was useful for us.

[mikehardy]

get the path where the application is installed? What do you need that route for?

This is a discussion about the external storage path in the device. Google disallows use of that path for all apps except file management apps, starting with android 11 targetSdkVersion. So it can be a real concern

It's not the path to the app install, though you never know what some app might need. App install path is fine by Google though