# Python Kwargs Setattr Security

> When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime. Use this to apply the allowlist pattern that prevents arbitrary file writes and other attacks via reflected property access. Use when this capability is needed.

- Skill: `tomevault-io/python-kwargs-setattr-security` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/python-kwargs-setattr-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/python-kwargs-setattr-security/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/python-kwargs-setattr-security

---


## Problem Pattern

Using `hasattr(obj, k) / setattr(obj, k, v)` with user-controlled kwargs is insecure. The `hasattr` check is NOT a security guard — it returns True for ALL exposed properties including dangerous ones.

```python
# INSECURE — do not use
for k, v in kwargs.items():
    if hasattr(options, k):
        setattr(options, k, v)
```

## Fix: Explicit Allowlist

Define a module-level frozenset of safe attribute names. Raise RuntimeError for known-but-blocked attrs; silently ignore unknown keys.

```python
# Define at module level, before the class
_ALLOWED_SESSION_OPTIONS = frozenset({
    "enable_cpu_mem_arena",
    "enable_mem_pattern",
    # ... only explicitly reviewed safe attrs
})

# In the method
for k, v in kwargs.items():
    if k in _ALLOWED_SESSION_OPTIONS:
        setattr(options, k, v)
    elif hasattr(options, k):  # reuse the existing instance, don't create new
        raise RuntimeError(
            f"SessionOptions attribute '{k}' is not permitted via the backend API. "
            f"Allowed attributes: {', '.join(sorted(_ALLOWED_SESSION_OPTIONS))}"
        )
    # else: silently ignore (may be kwargs for a different config object)
```

## Key Rules

1. **Use the existing object** in `hasattr(options, k)` — never `hasattr(ClassName(), k)` (creates throwaway C++ objects per iteration)
2. **RuntimeError** is the ORT convention for API misuse errors (not ValueError)
3. **Silent ignore for one path is OK when kwargs are forwarded to both paths**: `run_model()` passes the same kwargs dict to both `prepare()` (validates SessionOptions) and `rep.run()` (validates RunOptions). A RunOptions kwarg unknown to SessionOptions is silently ignored by `prepare()` — this is correct because `rep.run()` will validate it. Only raise RuntimeError when the attr exists on the target object but is blocked.
4. **Frozenset constant naming**: `_ALLOWED_<CLASSNAME>` — ALL_CAPS, Google Style
5. **No type annotations** on module-level constants (ORT Python convention)

## Dangerous SessionOptions Properties (never allowlist)

- `optimized_model_filepath` — triggers Model::Save(), overwrites arbitrary files
- `profile_file_prefix` + `enable_profiling` — writes profiling JSON to arbitrary path
- `register_custom_ops_library` — loads arbitrary shared libraries (method, not property)

## Files in ONNX Runtime

- `onnxruntime/python/backend/backend.py` — `_ALLOWED_SESSION_OPTIONS`
- `onnxruntime/python/backend/backend_rep.py` — `_ALLOWED_RUN_OPTIONS`
- Tests: `onnxruntime/test/python/onnxruntime_test_python_backend.py` — `TestBackendKwargsAllowlist`

---
> Source: [microsoft/onnxruntime](https://github.com/microsoft/onnxruntime) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-25 -->