Audit callables available via Custom Script API and apply protections as necessary #11661

New Issue

adam · 2025-12-29T21:48:14+01:00

adam commented

2025-12-29 21:48:14 +01:00

Originally created by @jnovinger on GitHub (Sep 29, 2025).

Proposed Changes

Audit callable methods, functions, and properties in NetBox core that can be accessed from Jinja2 sandbox environments and add alters_data=True attribute to any that modify database state, alter file-system state, or perform unexpected side effects.

This ensures that methods which alter data or have side effects are explicitly marked with Django's template protection mechanism, preventing accidental calls from Jinja2 sandbox environments (config templates, export templates, webhooks, custom links).

Specific actions:

Review callable methods across NetBox core code that could be accessed via templates:
- Model methods (custom methods beyond Django's auto-protected save/delete)
- Manager methods
- QuerySet methods
- Utility functions accessible in template contexts
- Properties that trigger database writes or external operations
Add alters_data=True to any callable that:
- Modifies database records (create, update, delete operations)
- Performs file system operations (read/write/delete files)
- Makes external API calls or network requests
- Triggers background jobs or tasks
- Modifies cache or session data
- Has any side effects beyond data retrieval/calculation
Focus on methods potentially accessible from template contexts (config templates, export templates,
webhooks, custom links)

Examples:

  def sync_external_data(self):
      # External API calls, file operations, etc.
      pass
  sync_external_data.alters_data = True

  @property
  def refresh_cache(self):
      # Updates cache as side effect
      pass
  refresh_cache.alters_data = True

Justification

While NetBox's current security assessment considers template sandbox access appropriate for users with template permissions, explicitly marking methods with side effects provides defensive security benefits:

Protects against potential changes in Django/Jinja2 behavior that might expose currently-safe methods
Makes it explicit which methods are intended to be unsafe for template contexts
Covers potential side effects in NetBox core
Follows Django's established pattern and extends it systematically
Adds an extra layer of protection complementing existing access controls

Originally created by @jnovinger on GitHub (Sep 29, 2025). ### Proposed Changes Audit callable methods, functions, and properties in NetBox core that can be accessed from Jinja2 sandbox environments and add `alters_data=True` attribute to any that modify database state, alter file-system state, or perform unexpected side effects. This ensures that methods which alter data or have side effects are explicitly marked with Django's template protection mechanism, preventing accidental calls from Jinja2 sandbox environments (config templates, export templates, webhooks, custom links). Specific actions: 1. Review callable methods across NetBox core code that could be accessed via templates: - Model methods (custom methods beyond Django's auto-protected save/delete) - Manager methods - QuerySet methods - Utility functions accessible in template contexts - Properties that trigger database writes or external operations 2. Add alters_data=True to any callable that: - Modifies database records (create, update, delete operations) - Performs file system operations (read/write/delete files) - Makes external API calls or network requests - Triggers background jobs or tasks - Modifies cache or session data - Has any side effects beyond data retrieval/calculation 3. Focus on methods potentially accessible from template contexts (config templates, export templates, webhooks, custom links) Examples: ```py def sync_external_data(self): # External API calls, file operations, etc. pass sync_external_data.alters_data = True @property def refresh_cache(self): # Updates cache as side effect pass refresh_cache.alters_data = True ``` ### Justification While NetBox's current security assessment considers template sandbox access appropriate for users with template permissions, explicitly marking methods with side effects provides defensive security benefits: 1. Protects against potential changes in Django/Jinja2 behavior that might expose currently-safe methods 2. Makes it explicit which methods are intended to be unsafe for template contexts 3. Covers potential side effects in NetBox core 4. Follows Django's established pattern and extends it systematically 5. Adds an extra layer of protection complementing existing access controls

adam added the type: housekeeping netbox status: backlog labels 2025-12-29 21:48:14 +01:00

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#11661