title: Google App Engine - Modify ancestral parts of key to circumvent authorization
body: <p><em>My question is concerning a vulnerability where a malicious user might modify part of a key which contains a serious of ancestors, in order to preform an unauthorized action.</em></p>
  
  <p>Let's say I have three types of elements MyParentEntity, MyChildEntity, and MyGrandchildEnity</p>
  
  <p>The list of authorized user on a particular entity group is stored on the MyParentEntity. So if I where to get a MyGrandchildEnitty by key my resource would extract the key of the corresponding MyParentEntity from the MyGrandchildEnitty key. Then load the MyParentyEntity with said extracted key and see if the current user was on the list of authorized users.</p>
  
  <p>Simple enough, but consider this.</p>
  
  <p>A malicious user wants to add a MyGrandchildEnity as a child of MyChildEntity on which they are not authorized. They attempt the following.</p>
  
  <p>Before they submit the  MyGrandchildEnity, they change the part of it's parent key that refers to the MyParentEntity to a key of a MyParentEntity in which they are authorized. That way when the resource extracts the MyParentEntity key from the  MyGrandchildEnity's parent key it loads a MyParentyEntity in which authorization passes and then proceeds to insert the  MyGrandchildEnity they submitted. </p>
  
  <p>Now consider the parent key of the MyGrandchildEnity they inserted. The part of that key which contains the key of the MyParentyEnity is that of an entity they have authorization on, but the part of the key which contains the MyChildEnity key is that of an entity they do not have permission on. </p>
  
  <p>This is just preliminary, but if you authorization data is only on the most root entity it seems as there might be way of tweaking parts of a key to gain unauthorized access.</p>
  
  <p><strong>Question One: Would this attack work?</strong></p>
  
  <p><strong>Question Two: If so, how would you defend such a thing?</strong></p>
  
  <p><strong>-- UPDATE: --</strong></p>
  
  <p>When you save an entity with a parent key does the Datastore verify that parent exist, as in an entity with that key exactly? Cause that would eliminate this vulnerability.</p>
  
  <p>After playing around looks like there is no such check.</p>