I have a base64 string and I want to open the correspondent file generated from this string, but without saving it to the phone’s storage.
Initially, I have created a file from this base64 string and saved it to temporary storage, then open it, using open_file plugin from Flutter. But after I upload the .apk to AppSweep, it returns the following issue: Insecure file location is retrieved via getExternalMediaDirs. I have observed that the issue comes from the open_file library. Is there any other solution?
Uint8List buffer = base64Decode(fileContent);
final directory = await getTemporaryDirectory();
int lastDotIndex = fileName.lastIndexOf('.');
String formattedFileName = fileName.substring(0, lastDotIndex);
String extension = fileName.substring(lastDotIndex + 1);
File file = File(
"${directory!.path}/${formattedFileName}.$extension");
await file.writeAsBytes(buffer);
await OpenFile.open(file.path);
2
Answers
The Issue
Insecure file location is retrieved via getExternalMediaDirs
only appears if your app callsandroid.content.Context.getExternalMediaDirs()
.This is because those locations are not particularly secure see Android Docu:
The only file-related API you are using is
getTemporaryDirectory
, but that does not seem to store in the media dir, so I don’t think this call is the reason for this finding.Typically, AppSweep shows you the exact location and a code snippet of what it finds, does that help you to investigate the problem more?
Btw, if you want direct help in AppSweep, feel free to use the chat on the bottom right, then you can talk to one of the AppSweep team (e.g. me) directly.
To open a file generated from a base64 string without saving it to the phone’s storage in Flutter, you can use a combination of in-memory file creation and a suitable plugin or method to open the file directly from memory. As of my last update, Flutter doesn’t have a built-in way to directly open files from memory, but you can use alternative methods.
One approach is to use the share_plus plugin to share the file directly from memory without saving it. This method creates a temporary file in memory and then shares it using the device’s share dialog, allowing the user to open it with any compatible application installed on their device.
Here’s an example of how you can implement this:
This method doesn’t save the file to disk, avoiding the issue with insecure file locations. It leverages the device’s sharing mechanism to open the file, giving users the flexibility to choose an appropriate app to view or handle the file. Keep in mind that this approach depends on the user having an app installed that can open the file type you’re sharing.