Dynamic method dispatch (ARCH2132)

Key python.security.dynamic-method-dispatch · Severity warning · Category security · CWE CWE-470

Resolving the method to call with getattr from user input lets an attacker invoke methods never meant to be exposed. This can lead to unexpected behavior and bypassed security checks.

Incorrect

def dispatch(self, request):
    action = request.GET["action"]
    return getattr(self, action)()

Correct

ALLOWED = {"list": "_list", "show": "_show"}

def dispatch(self, request):
    action = request.GET["action"]
    method = ALLOWED.get(action)
    if method is None:
        raise Http404
    return getattr(self, method)()

Fix

Map callable methods through an explicit allowlist; never pass raw user input to getattr.