starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-14 14:23:32 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

[PR #20315] [MERGED] Fixes #20236: Improve file naming and upload handling #15886

New Issue
Closed
opened 2025-12-30 00:24:36 +01:00 by adam · 0 comments
adam commented 2025-12-30 00:24:36 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/netbox-community/netbox/pull/20315
Author: @pheus
Created: 9/10/2025
Status: ✅ Merged
Merged: 9/13/2025
Merged by: @jnovinger

Base: main ← Head: 20236-sanitize-image-attachment-name

📝 Commits (1)

  • 615cad3 fix(extras): Improve file naming and upload handling

📊 Changes

4 files changed (+273 additions, -22 deletions)

View changed files

📝 netbox/extras/models/models.py (+4 -2)
📝 netbox/extras/tests/test_models.py (+85 -7)
📝 netbox/extras/tests/test_utils.py (+142 -1)
📝 netbox/extras/utils.py (+42 -12)

📄 Description

Fixes: #20236

Summary
Silently normalize the on‑disk filename derived from image attachments to prevent nested directories and path traversal, while preserving the user‑entered name in the database/UI unchanged.

What’s changed

  • In upload_to:
    • Normalize browser paths (e.g. C:\fakepath\photo.jpg) and extract the real uploaded extension.
    • Use the user‑entered name when present; sanitize via Django’s filename utility.
    • Prefix with {object_type.model}_{object_id} and validate the final relative path with validate_file_name(..., allow_relative_path=True).
    • Preserve only known image extensions (bmp, gif, jpeg, jpg, png, webp); otherwise save without an extension.
  • (Hardening) Guard filename parsing to avoid IndexError if older files don’t follow the expected underscore pattern.

Behavior before

  • Supplying slashes in the name could create subdirectories and trigger IndexError in code that assumes a fixed filename layout.

Behavior after

  • Files are always stored under image-attachments/ with a flat, safe basename.
  • The value shown/stored in the name field is not altered; only the on‑disk filename is normalized.

Notes for reviewers

  • This follows the maintainer guidance to silently normalize rather than reject slashes.
  • No user‑visible changes to the name field or forms.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbox-community/netbox/pull/20315 **Author:** [@pheus](https://github.com/pheus) **Created:** 9/10/2025 **Status:** ✅ Merged **Merged:** 9/13/2025 **Merged by:** [@jnovinger](https://github.com/jnovinger) **Base:** `main` ← **Head:** `20236-sanitize-image-attachment-name` --- ### 📝 Commits (1) - [`615cad3`](https://github.com/netbox-community/netbox/commit/615cad3fa7f82f97dc7ff1a6bd85c0a917be6bc5) fix(extras): Improve file naming and upload handling ### 📊 Changes **4 files changed** (+273 additions, -22 deletions) <details> <summary>View changed files</summary> 📝 `netbox/extras/models/models.py` (+4 -2) 📝 `netbox/extras/tests/test_models.py` (+85 -7) 📝 `netbox/extras/tests/test_utils.py` (+142 -1) 📝 `netbox/extras/utils.py` (+42 -12) </details> ### 📄 Description ### Fixes: #20236 **Summary** Silently normalize the **on‑disk filename** derived from image attachments to prevent nested directories and path traversal, while preserving the **user‑entered `name`** in the database/UI unchanged. **What’s changed** - In `upload_to`: - Normalize browser paths (e.g. `C:\fakepath\photo.jpg`) and extract the real uploaded extension. - Use the user‑entered `name` when present; sanitize via Django’s filename utility. - Prefix with `{object_type.model}_{object_id}` and validate the final relative path with `validate_file_name(..., allow_relative_path=True)`. - Preserve only known image extensions (`bmp`, `gif`, `jpeg`, `jpg`, `png`, `webp`); otherwise save without an extension. - (Hardening) Guard filename parsing to avoid `IndexError` if older files don’t follow the expected underscore pattern. **Behavior before** - Supplying slashes in the `name` could create subdirectories and trigger `IndexError` in code that assumes a fixed filename layout. **Behavior after** - Files are always stored under `image-attachments/` with a flat, safe basename. - The value shown/stored in the `name` field is **not altered**; only the on‑disk filename is normalized. **Notes for reviewers** - This follows the maintainer guidance to **silently normalize** rather than reject slashes. - No user‑visible changes to the `name` field or forms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-30 00:24:36 +01:00
adam closed this issue 2025-12-30 00:24:36 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#15886
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?