Attribute requestLegacyExternalStorage set

Attribute requestLegacyExternalStorage set

Risk: low

Description

The android:requestLegacyExternalStorage attribute grants access to directories and different types of media files stored in external storage.

This attribute works only for Android 10 (API level 29), on Android 11 and later, the system ignores the requestLegacyExternalStorage flag.

Recommendation

Avoid setting the attribute android:requestLegacyExternalStorage and use only scoped storage to guarantee a better protection to app and user data on external storage.

XML

<application android:icon="@drawable/icon" android:requestLegacyExternalStorage="true">

Links

• Storage updates in Android 11

Standards

• OWASP_MASVS_L1:
  • MSTG_STORAGE_4
• OWASP_MASVS_L2:
  • MSTG_STORAGE_4
• PCI_STANDARDS:
  • REQ_3_5
  • REQ_6_2