Android SD Card Path

ID

kotlin.android_sdcard_path

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

low

Resource

Code Smell

Language

Kotlin

Tags

android, portability

Description

Flags Kotlin string literals that contain hardcoded SD card paths such as /sdcard, /mnt/sdcard, or /storage/sdcard0. These paths are not part of the public Android platform contract and break on modern Android versions under scoped storage (API 29+). The location of removable storage is device-, OEM-, and user-specific.

Rationale

val f = File("/sdcard/data")                  // FLAW
val p = "/mnt/sdcard/photos"                  // FLAW
val q = "/storage/sdcard0/music"              // FLAW

val rel = "sdcard/data"                       // OK — relative path
val url = "https://example.com/sdcard/path"   // OK — URL prefix

Even when the literal happens to resolve at runtime on the developer’s device, the same code will fail on devices with internal-only storage, on Android 11+ scoped storage, and on the Play Store’s pre-launch report.

Remediation

  • Use Context.getExternalFilesDir(…​) for app-private files on shared storage.

  • Use Environment.getExternalStorageDirectory() only behind a documented compatibility shim — and prefer the Storage Access Framework for user-visible files.

  • For media files, use MediaStore and ContentResolver.

References