Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 81% confidence
- Finding
- Here, filter keys come from the caller-supplied filters dict and are passed directly into getattr(self.__model__, key). Although SQLAlchemy prevents raw SQL injection here, an untrusted caller can probe or access unintended model fields, trigger exceptions for invalid attributes, and bypass intended business restrictions by filtering on sensitive/internal columns such as del_flag, token, or source_id. In a skill handling highly sensitive pregnancy-related monitoring data, loose query-field exposure increases privacy and abuse risk.