Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 76% confidence
- Finding
- Here, filter keys are taken from the caller and passed into getattr(self.__model__, key) without validation. While SQLAlchemy prevents classic SQL injection in the value position, untrusted field selection can still expose unintended columns, trigger exceptions for invalid attributes, and enable abuse of generic query surfaces in higher layers that should restrict searchable fields. In a shared pet-care skill environment, this could weaken access control or leak metadata if upstream callers can influence filters.