Python mass assignment: setattr with request data
Rule ID: vetkit.py.mass-assignment.request-setattr
Attribute names taken from request data are written onto an object with setattr() or __dict__.update() without an allow-list. Clients can set any field, including is_admin or password (mass assignment).
Last updated:
Suite: Security
python
Attribute names taken from request data are written onto an object with setattr() or __dict__.update() without an allow-list. Clients can set any field, including is_admin or password (mass assignment).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Validate the body with a schema (pydantic / marshmallow) that lists the writable fields, or check every key against an explicit allow-list before assigning it.
References
Source: packages/engine/rules/sast/python.yml.
Related checks
- Python assert used for authorization is removed by -O
- Python hardcoded password or API key compared to literal
- Python cleartext FTP or Telnet connection (ftplib, telnetlib)
- Python cloud SDK client with hardcoded secret access key
- Python eval() and exec() with non-literal argument
- Python dynamic import of module name from request input
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.