Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 77% confidence
- Finding
- Using getattr(self.__model__, key) with keys taken from a caller-provided filters dict creates a generic mass-query surface over any model attribute. While SQLAlchemy prevents classic SQL injection here, an attacker or unintended caller can enumerate or query on sensitive/internal fields and trigger exceptions on invalid names, which broadens data access beyond intended business constraints.