starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

[PR #9940] [MERGED] Fixes #9919: XSS Bypass in custom fields displayed in tables #13534

New Issue
Closed
opened 2025-12-29 23:19:25 +01:00 by adam · 0 comments
adam commented 2025-12-29 23:19:25 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/netbox-community/netbox/pull/9940
Author: @0xdeadbeer
Created: 8/6/2022
Status: ✅ Merged
Merged: 8/8/2022
Merged by: @jeremystretch

Base: develop ← Head: develop

📝 Commits (4)

  • f874e99 Added HTML Sanitization to the custom fields
  • db38ed4 Fixed the XSS protection code inside custom fields
  • 7141fc8 Custom fields - removed the debug lines
  • 0e1947b PEP8 fix

📊 Changes

1 file changed (+4 additions, -3 deletions)

View changed files

📝 netbox/netbox/tables/columns.py (+4 -3)

📄 Description

Fixes: #9919

Escaping CustomFieldColumn's value before rendering it to prevent XSS.
escaping

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbox-community/netbox/pull/9940 **Author:** [@0xdeadbeer](https://github.com/0xdeadbeer) **Created:** 8/6/2022 **Status:** ✅ Merged **Merged:** 8/8/2022 **Merged by:** [@jeremystretch](https://github.com/jeremystretch) **Base:** `develop` ← **Head:** `develop` --- ### 📝 Commits (4) - [`f874e99`](https://github.com/netbox-community/netbox/commit/f874e9932d06653e330da65d93c2fe0fd7720968) Added HTML Sanitization to the custom fields - [`db38ed4`](https://github.com/netbox-community/netbox/commit/db38ed4f19e5943bf60434f4cfc08d232dbb5e6e) Fixed the XSS protection code inside custom fields - [`7141fc8`](https://github.com/netbox-community/netbox/commit/7141fc8eb03eeba0d751e7af374f7d6a92ea60cb) Custom fields - removed the debug lines - [`0e1947b`](https://github.com/netbox-community/netbox/commit/0e1947bc4bceaf01d519bc7cc2e9fc09768b0409) PEP8 fix ### 📊 Changes **1 file changed** (+4 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `netbox/netbox/tables/columns.py` (+4 -3) </details> ### 📄 Description ### Fixes: #9919 Escaping CustomFieldColumn's value before rendering it to prevent XSS. ![escaping](https://user-images.githubusercontent.com/64986162/183255375-60922d6b-a52e-4963-9a08-a2287487d6bf.png) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 23:19:25 +01:00
adam closed this issue 2025-12-29 23:19:25 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#13534
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?