Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 82% confidence
- Finding
- Here getattr(self.__model__, key) uses keys from the caller-supplied filters dict, so untrusted input can select arbitrary model attributes and trigger unexpected query behavior or exceptions. While SQLAlchemy prevents classic SQL injection here, this still creates a denial-of-service and authorization-scope risk if higher layers pass user-controlled filter names to enumerate or probe fields not intended for exposure.