1

I'm running into a strange issue with the Google Drive SDK — I'm not sure if this is the designed behavior or if it's a bug in the scoping.

Quick background: we're developing an application using the "drive.files" scope (e.g. only files / folders created by our app) and we want to list all folders created by our app. So we use the drive.files.list method call (using the Javascript client API), with a query for the drive folder mimeType:

mimeType = 'application/vnd.google-apps.folder'

The problem: what comes back is a list of all folders in the user's Drive account, not just the ones created by our app.

Is this not a blatant violation of scope? As far as I can tell, the documentation doesn't indicate whether we should expect to see out-of-scope files returned from search queries.

This behavior can be repeated using the Google APIs explorer:

  1. Open the Google APIs explorer: Google APIs Explorer: drive.files.list with empty query
  2. Turn OAuth authorization to ON, using only the drive.file authorization.
  3. Click "Execute" with an empty query. The results list should be empty.

  4. Now, enter the folder query into the 'q' parameter box:

    mimeType = 'application/vnd.google-apps.folder'

  5. Click "Execute". The results list shows folders in the users' Drive account that have not been created by the APIs Explorer app.

Am I missing something here? Is this the expected behavior? And if so — is there a better way to get the list of folders only created by our app?

gjuggler
  • 501
  • 5
  • 8

1 Answers1

1

Thanks for the report. The issue has been fixed and should work as expected now.

Steve Bazyl
  • 11,002
  • 3
  • 21
  • 24
  • Has this been corrected? [A similar issue was reported here](http://stackoverflow.com/questions/20690699/what-is-the-expected-behaviour-of-the-changes-feed-with-drive-file-scope). Is there anywhere to track the bug fixed in April? – JSuar Jan 02 '14 at 14:30
  • @SteveBazyl : the bug is still there. We're still able to list out-of-scope folders despite using a "drive.file" scope only: that can be easily proven [using the API explorer!](https://developers.google.com/apis-explorer/#s/drive/v2/drive.files.list?q=mimeType%20%253D%20%27application%252Fvnd.google-apps.folder%27) – Renaud Cerrato Apr 18 '14 at 09:43