{"record":{"id":"e4bd5d097c762bb6","repo":"geekcomputers/Python","slug":"invalid-customer-field","errorCode":null,"errorMessage":"Invalid customer field","messagePattern":"Invalid customer field","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"bank_managment_system/backend.py","lineNumber":103,"sourceCode":"        self.conn.commit()\n        self.acc_no += 1\n        return acc_no\n\n    def check_acc_no(self, acc_no):\n        self.cur.execute(\"SELECT 1 FROM bank WHERE acc_no=?\", (acc_no,))\n        return self.cur.fetchone() is not None\n\n    def get_details(self, acc_no):\n        self.cur.execute(\"SELECT * FROM bank WHERE acc_no=?\", (acc_no,))\n        return self.cur.fetchone()\n\n    def get_detail(self, acc_no):\n        self.cur.execute(\"SELECT name, balance FROM bank WHERE acc_no=?\", (acc_no,))\n        return self.cur.fetchone()\n\n    def update_customer(self, field, new_value, acc_no):\n        if field not in {\"name\", \"age\", \"address\", \"mobile_number\", \"account_type\"}:\n            raise ValueError(\"Invalid customer field\")\n        self.cur.execute(\n            f\"UPDATE bank SET {field}=? WHERE acc_no=?\", (new_value, acc_no)\n        )\n        self.conn.commit()\n\n    def update_balance(self, amount, acc_no):\n        self.cur.execute(\n            \"UPDATE bank SET balance = balance + ? WHERE acc_no=?\", (amount, acc_no)\n        )\n        self.conn.commit()\n\n    def deduct_balance(self, amount, acc_no):\n        self.cur.execute(\"SELECT balance FROM bank WHERE acc_no=?\", (acc_no,))\n        bal = self.cur.fetchone()\n        if bal and bal[0] >= amount:\n            self.cur.execute(\n                \"UPDATE bank SET balance=balance-? WHERE acc_no=?\", (amount, acc_no)\n            )","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/geekcomputers/Python/blob/40f4cd2652d75ef8e49d76e5c4d431d458712719/bank_managment_system/backend.py#L85-L121","documentation":"This ValueError is raised by update_customer when the requested column for the bank table is not in the allowed whitelist {name, age, address, mobile_number, account_type}. As with the staff updater, the column name is interpolated into an f-string SQL statement (column identifiers cannot be bound as SQL parameters), so the whitelist serves both validation and SQL-injection defense; balance updates must go through update_balance instead.","triggerScenarios":"Calling update_customer('balance', ...) (balance is deliberately excluded to force use of update_balance for transactional accounting), update_customer('acc_no', ...), or any typo/dynamically generated field name outside the exact set.","commonSituations":"Attempting to modify balance directly instead of via deposit/withdraw flows, frontend form field keys not matching backend names (e.g., 'mobile' vs 'mobile_number'), or renaming columns in the schema without updating the whitelist.","solutions":["Use only: 'name', 'age', 'address', 'mobile_number', 'account_type'","For balance changes, call update_balance(amount, acc_no) so the change goes through the proper path","Align frontend field identifiers with the whitelist and fix typos","If adding a new editable column, update both schema and whitelist"],"exampleFix":"# before\nbackend.update_customer('balance', 999999, '12345')  # ValueError\n\n# after\nbackend.update_balance(999999, '12345')  # via proper transaction API","handlingStrategy":"validation","validationCode":"VALID_CUSTOMER_FIELDS = {'name', 'age', 'address', 'mobile_number', 'account_type'}\nif field == 'balance':\n    backend.update_balance(new_value, acc_no)\nelif field in VALID_CUSTOMER_FIELDS:\n    backend.update_customer(field, new_value, acc_no)","typeGuard":"def is_valid_customer_field(field) -> bool:\n    return field in {'name', 'age', 'address', 'mobile_number', 'account_type'}","tryCatchPattern":"try:\n    backend.update_customer(field, new_value, acc_no)\nexcept ValueError as e:\n    print(f'Rejected customer field update: {e}')","preventionTips":["Route balance changes exclusively through update_balance to preserve transaction integrity","Keep form field keys in exact sync with backend whitelists","Add new columns to schema and whitelist in the same change; cover with a test"],"tags":["python","sql","validation","whitelist","backend"],"backgroundTag":"invalid-field-name","analyzedSha":"40f4cd2652d75ef8e49d76e5c4d431d458712719","analyzedAt":"2026-08-27T11:12:20.313Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}