Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 78% confidence
- Finding
- The list() method accepts caller-supplied filter keys and passes them into getattr(self.__model__, key) without validation. While SQLAlchemy still parameterizes values and prevents classic SQL injection, an untrusted caller can probe model internals, trigger exceptions for invalid attributes, and query on sensitive columns that should not be externally filterable, enabling unauthorized data discovery or denial-of-service through repeated failures.