Code RoomSetattr bypasses field whitelist

HardPrep Room Coding #1989

Setattr bypasses field whitelist

Code reviewCode quality & reviewSenior–Staff~25 min

Review this Python user-update endpoint that spreads the request body onto the model.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 25 min

Mark a line and say what kind of problem it is.0 findings

1@app.put('/account')

2def update_account():

3 body = request.get_json()

4 user = current_user()

5 for key, value in body.items():

6 setattr(user, key, value) # apply all submitted fields

7 db.session.commit()

8 return jsonify(user.to_dict())

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.