Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 76% confidence
- Finding
- This code applies user-supplied filter keys directly via getattr(self.__model__, key) with no allowlist or existence check. While SQLAlchemy prevents classic SQL injection here, an attacker controlling filter names can trigger exceptions, enumerate model structure, or query unintended sensitive columns such as token fields, which is more concerning given this skill stores identity and token data unrelated to fatigue detection.