Firebase Storage publicly listable
Scan rule · RSC-SEC-130
- Security
- Severity: Critical
- CWE-284
- OWASP A01-2021
Queries the bucket from the app's `storageBucket` configuration anonymously with `maxResults=1` and only evaluates whether listing is allowed and whether the list is empty — file and folder names are discarded, never stored.
Why this matters
Firebase Storage is the file store behind profile pictures, ID photos and uploaded documents. If the rules allow anonymous listing, anyone gets the complete file list — and then downloads every file one by one. That is how IDs and selfies of users of the Tea app became public.
The mistake arises as with Firestore: the default rules block every upload, the fastest way to get going is `allow read, write: if true`, and it stays. The configuration with the bucket name ships in every bundle.
We check with exactly one request, without a key and without signing in, and only read whether the response is a non-empty list. Fix: bind reads to the owner (`match /users/{userId}/{file=**} { allow read: if request.auth.uid == userId; }`), then scan again.
Scan tier
- External scan (anonymous)
How to fix it
In `storage.rules`, bind read and list access to `request.auth.uid` and the user path; keep public files in a separate folder without list access.