CODEWITHSUNDEEP
google-app-engineblobstore
Matt Faus
Matt Faus

Reputation: 6681

How secure is str(BlobKey)?

I have implemented a generic blob serving handler as mentioned in the appengine docs. The handler will serve any blob to you, as long as you know that blob's key string. I am using it to easily compose URLs that clients can use to download their files. If client A inspects the URL to download their file and finds their blob key (i.e. 1CX2kh468IDYKGcDUiq5c69u8BRXBtKBYcIaJkmSbSa4QY096gGVaYCZJjGZUpDz == str(BlobKey)), can they somehow reverse-engineer this key and easily construct another key that can be used to download client B's files? Or does the key have a random component added?

For reference, there is this note about str(db.Key), which is what raises my question:

Note: The string representation of a key looks cryptic, but is not encrypted! It can be converted back to the raw key data, both kind and identifier. If you don't want to expose this data to your users (and allow them to easily guess other entities' keys), then encrypt these strings or use something else.

I am creating the files like this, which does not specify a filename parameter, so I think the question boils down to, how does create() "pick" a filename when one is not specified? I suppose I could generate a random filename and pass it in here to be doubly sure this is secure.

file_name = files.blobstore.create(mime_type='application/octet-stream')

Upvotes: 2

Views: 305

Answers (2)

voscausa
voscausa

Reputation: 11706

Assign a filename when creating a blob:

name = .....
file_name = files.blobstore.create(mime_type='application/octet-stream', _blobinfo_uploaded_filename=name)

And you do not need to use str(BlobKey). The BlobKey can be part of your serving url

Upvotes: 1

maddyblue
maddyblue

Reputation: 16882

BlobKeys are non guessable. If a user has one key, that in no way enables them to guess another key. Unlike datastore keys, which contain full path information, BlobKeys do not encode any such data. You can share them safely without risk of a user doing an attack as you describe.

(I could not locate docs for these claims - this is based on my recollection.)

Upvotes: 2

Related Questions