Can a script on Google Docs or Google Sheets really access all my Google Drive files?

Question

I see this security risk listed in my google account security check-up:

"App details Has access to:

• See, edit, create and delete your spreadsheets in Google Drive
• See, edit, create and delete all of your Google Drive files
• Connect to an external service Display and run third-party web content in prompts and sidebars inside Google applications Allow this application to run when you are not present"

This is specifically a script in a Google Sheets file that requested access and I allowed it but when it requested access it didn't say this was going to happen??

How does Google's model for this work even? It doesn't make sense to me that this would literally work like that.

I am asking power users of web apps because what I would like to understand is the security/access model that is used and I just cannot believe that it literally would work like this.

Answer 1

Yes, a script from Google Apps Script on any Google Workspace Editor (Docs, Forms, Slides, Sheets) or any other place can access all your Google Drive files if they have requested the corresponding permission and you authorized the script to run.

The authorization technology is called OAuth. It handles permissions through OAuth scopes; the scope that allows the script to access all the user Google Drive files is https://www.googleapis.com/auth/drive

Reference

• https://developers.google.com/apps-script/guides/services/authorization
• https://developers.google.com/identity/protocols/oauth2/scopes

---

You might not remember it, but when a script that requires authorization is ran for first time it asks the user to review the permissions required by showing a OAuth consent screen. This screen shows a list of all the required permissions including links to the description of each of them. What you are seeing on the Google Account security checkup page matches what was shown in the OAuth consent screen.

If the script is changed to add more permissions that was previously authorized by the user, the next time that the scrip is ran a new request to review the required permissions will shown, if the new permissions aren't authorized, then the script will not run.

If you don't trust the script author the best is to remove the authorization.

Related

• Building a Summary-of-Projects sheet

Related discussion on official Google Apps Script Community

• Is it a common practice for app or script programmers to request access to all files even when unnecessary?