Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 83% confidence
- Finding
- Using getattr(self.__model__, key) on unvalidated filter keys allows callers to select arbitrary mapped attributes and can trigger exceptions or expose broader query capabilities than intended. While SQLAlchemy prevents classic SQL injection here, this still creates an unsafe mass-query surface that can be abused for unauthorized field-based querying or denial-of-service through malformed keys.