Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query

The query builder for the Analytics API is vulnerable to a confusion attack. The `dim_reports` and `dim_hacker_reports` tables both pull their data from the `Analytics::DimReport` model. When applying a `WHERE` clause or `HAVING` clause with a `FILTER` in the HackerOne Analytics Query Language …

'dim_reports': {
  'model': 'Analytics::DimReport',
  'columns': {
    'report_id': TYPE_NUMBER,
    'is_triage_sla_missed': TYPE_BOOLEAN,
  }
}