Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Content
if filters: for key, value in filters.items(): query = query.filter(getattr(self.__model__, key) == value) if offset: query = query.offset(offset)- Confidence
- 69% confidence
- Finding
- This query builder applies filter keys from a caller-supplied dictionary directly via getattr(self.__model__, key) without validating the field name. While SQLAlchemy prevents classic SQL injection here, untrusted callers can enumerate or query on unintended model fields, potentially exposing sensitive records or enabling authorization bypass if higher layers rely on restricted filtering.