Re:OneDrive File Picker Flaw Provides Apps Full Read Access ...
by TowerTall on Monday June 02, 2025 @08:09AM
(#44157985)
OneDrive is rooted in Git Virtual File System (was GVFS / now VFS for Git) [1] and has historically been used by the Microsoft developer division to manage very large Git repositories where files were downloaded on demand.
Git’s model inherently is repository-wide access – if you can clone a repo, you get all its files. There is no built-in concept of per-file read permissions in Git.
Git and OneDrive emphasize a single large namespace (a repository or a personal drive) that authorized users can fully access, with optimization focused on sync and storage rather than fine-grained security boundaries. They assume a top-level trust (the user or app is either allowed or not allowed to access the dataset).
To get a sense of the scope of what it would take for Microsoft to implement fine-grained permission levels into OneDrive. It would be similar to implementing it into Git.
Git’s model inherently is repository-wide access – if you can clone a repo, you get all its files. There is no built-in concept of per-file read permissions in Git.
Git and OneDrive emphasize a single large namespace (a repository or a personal drive) that authorized users can fully access, with optimization focused on sync and storage rather than fine-grained security boundaries. They assume a top-level trust (the user or app is either allowed or not allowed to access the dataset).
To get a sense of the scope of what it would take for Microsoft to implement fine-grained permission levels into OneDrive. It would be similar to implementing it into Git.
[1] https://github.com/microsoft/VFSForGit