How to prevent the creation of data readable by all customers in a Parse table? - parse-platform

Question

I have a table called Goals with default CLP (Public read and write).
My mobile app has default ACL set so that only the owner for the data can read and write from it.
Let’s now assume that someone is able to obtain the client keys maliciously from the app, and add an entry in the table Goals without ACL using a command like that:
curl -X POST \
-H "Content-Type: application/json" \
-H "X-Parse-Application-Id: xyx” \
-H "X-Parse-REST-API-Key: 12345” \
-d "{\"name\":\"whatever\"}" \
https://api.parse.com/1/classes/goals
Now every user will load this new data, I would like to prevent that.
I assume there are two options:
Prevent Rest API users from writing data without ACL or with a Public ACL, perhaps with some CloudCode
In the app filter out the data that doesn't belong directly to that user
My question is, are the two above the only available options? Is the first option only doable with Cloud Code?

Answer 1

Ok, let's try this again. I think the best solution in this case is to create a beforeSave trigger in cloud-code that sets the ACL the way you want it. With the Parse Javascript SDK, you can construct an ACL that only gives access to the user passed to it in the constructor. Something like this (untested code):
Parse.Cloud.beforeSave("Goal", function(request, response) {
request.object.setACL(new Parse.ACL(Parse.User.current()));
response.success();
});
Note: I used this post as a reference. And this too