starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-13 13:53:31 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Add a Sandbox security consideration to warn of unfettered DB access. #11622

New Issue
Open
opened 2025-12-29 21:47:44 +01:00 by adam · 1 comment
adam commented 2025-12-29 21:47:44 +01:00
Owner
Copy Link

Originally created by @jchambers2012 on GitHub (Sep 16, 2025).

Change Type

Addition

Area

Administration

Proposed Changes

Add a warning to the documentation letting administrators know that the Jinja subsystem near full read only access to the database’s models and could allow for retrieving secrets for core and plugin and edit access to templates should only be extended to trusted administrators.
Add a new section to docs/administration/permissions.md with a section for Jinja Sandbox Warning with some kind of warning like:

Individual user permissions are NOT enforced within the NetBox Jinja Sandbox for exposed models. Only trust administrators should have edit rights to update an object and any synced template files should only come from a trusted source with similar permissions or change controls. This can potently expose cross-user/tenants information such as site and devices configurations or secrets.

A banner could be added to Configuration Templates model linking to this new section. This banner may also then be added to more models that use the sandbox such as Export Templates, Custom Links and Web Hooks that might have the potential to expose secrets via database models if testing detriments a risk might exist.

The Sandbox Template Engine has additional security considerations, please see: LINK

This has been verified by testing with a configuration template (that has access to all models) pulling a full list of un-truncated User Token and pulling all username and password from Data Source from a read only account that is limited to DCIM object only in 4.3.7

Originally created by @jchambers2012 on GitHub (Sep 16, 2025). ### Change Type Addition ### Area Administration ### Proposed Changes Add a warning to the documentation letting administrators know that the Jinja subsystem near full read only access to the database’s models and could allow for retrieving secrets for core and plugin and edit access to templates should only be extended to trusted administrators. Add a new section to docs/administration/permissions.md with a section for Jinja Sandbox Warning with some kind of warning like: >Individual user permissions are NOT enforced within the NetBox Jinja Sandbox for exposed models. Only trust administrators should have edit rights to update an object and any synced template files should only come from a trusted source with similar permissions or change controls. This can potently expose cross-user/tenants information such as site and devices configurations or secrets. A banner could be added to Configuration Templates model linking to this new section. This banner may also then be added to more models that use the sandbox such as Export Templates, Custom Links and Web Hooks that might have the potential to expose secrets via database models if testing detriments a risk might exist. >The Sandbox Template Engine has additional security considerations, please see: LINK This has been verified by testing with a configuration template (that has access to all models) pulling a full list of un-truncated User Token and pulling all username and password from Data Source from a read only account that is limited to DCIM object only in 4.3.7
adam added the type: documentationstatus: needs ownernetbox labels 2025-12-29 21:47:44 +01:00
adam commented 2025-12-29 21:47:45 +01:00
Author
Owner
Copy Link

@jchambers2012 commented on GitHub (Sep 18, 2025):

Cross referencing #20356 to point to some of the "side effects" as called out in https://jinja.palletsprojects.com/en/stable/sandbox/#security-considerations

@jchambers2012 commented on GitHub (Sep 18, 2025): Cross referencing #20356 to point to some of the "side effects" as called out in https://jinja.palletsprojects.com/en/stable/sandbox/#security-considerations
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label netbox status: needs owner type: documentation
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#11622
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?