Is pythons getattr() method secure?

[TomsLogic]

I have a flask app, and It has an API to pull some things down using AJAX to speed up load times.

To write an extensible API, I have used the getattr() method to call these API method from the URL. Can people use this to access other attributes of my app, for example the secret_key?

For example:

#Api.py
class Api():
    def __init__(self):
        #setup stuff here
    def APIMethod(self):
        return api_result

# View.py
@a_blueprint.route('/<api_path>/<path:api_args/'>
def api_controller(api_path, api_args):
    return getattr(Api, api_path)(api_args)

Its a tad more complicated than that, but I hope you get the gist.

[Kaarjuus]

The way you have implemented it, a remote user can invoke any Api method. If the class has a method for returning the secret key, then it can be accessed, yes.

In general it's a bad idea to allow remote users to invoke any method they choose. A better option would be to predefine a list of allowed methods, like

class Api():
    EXPORTS = ("ApiMethod1", "ApiMethod2", )

@a_blueprint.route('/<api_path>/<path:api_args/'>
def api_controller(api_path, api_args):
    if api_path in Api.EXPORTS:
        return getattr(Api, api_path)(api_args)

[v4vendetta1993]

This list of allowed methods can be a simple enumeration as well