GAE ndb security issue?

Question

I have two mock users Jo and Sam with the respective ids 117138609372751079516 and 144229817858159123282.

The app has the following entity:

class MockEntity(ndb.Model):
    ownerId = ndb.StringProperty(default=users.get_current_user().user_id())

When both are logged in at the same time and either user saves/puts the entity for the first time, the property 'ownerId' is randomly populated with either of the user's id: 117138609372751079516 OR 144229817858159123282

Using a pre_put_hook seems to resolve the issue:

def _pre_put_hook(self):
    if not self.ownerId:
        self.ownerId = users.get_current_user().user_id()

I've solved my immediate problem, BUT WHY IS THIS HAPPENING in the first place? This has been tested in development and also production with a group of about 50 testers. About 40% of them could see entities that were not theirs.

never ever use the result of some dynamic call as a default value - default=users.get_current_user().user_id() this will only be run once on import, all subsequant instantiations of the class will get the same value. Create a factory (class method) that sets ownerId with a call to users.get_current_user().user_id() if one has not been supplied after the instance has been created or pass it in as an argument when you create the instance. — Tim Hoffman

Jon Jon · Accepted Answer · 2013-03-26T23:42:35

The problem is likely due to the default value of ownerId being set only the first time the class MockEntity is created for each App Engine runtime instance. Therefore when a new App Engine instance loads up default value is set by the first user to load the class into the Python interpreter.

See Gotcha — Mutable default arguments for this classic issue in Python and App Engine NDB Gotcha PickleProperty Default Value for an explanation of the same situation in NDB.

GAE ndb security issue?

1 Answers