Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 78% confidence
- Finding
- Here, filter keys come from the caller and are passed into getattr(self.__model__, key) without validation. While SQLAlchemy prevents classic SQL injection in the value comparison, an attacker or untrusted caller can trigger access to unintended model attributes or cause exceptions/logic abuse by selecting unexpected field names, especially on a generic DAO reused across contexts.