Custom script log functions do not escape HTML entities #2917

New Issue

adam · 2025-12-29T18:23:24+01:00

adam commented

2025-12-29 18:23:24 +01:00

Originally created by @fchiron-qualys on GitHub (Sep 30, 2019).

Environment

Python version: 3.6.8
NetBox version: 2.6.5

Steps to Reproduce

Create a custom with logs containing HTML tag-looking data like output of python type()
Run the script

from extras.scripts import Script

class LogBugScript(Script):
    description = "HTML entities not escaped"

    def run(self, data):
        self.log_debug("int type: {}".format(type(2)))
        self.log_success("int type [fixed]: {}".format(type(2)).replace("<", "&lt;"))
        self.log_info("<pre>Can be nice</pre>")
        self.log_warning("<pre>Or not</pre>")
        self.log_failure("JS injection...<script lang='javascript'>alert('XSS')</script>")

log_* functions should escape HTML entities

log_* just output passed string as-is avoiding output of some texts and opening possibility of code injection.

Originally created by @fchiron-qualys on GitHub (Sep 30, 2019).  ### Environment * Python version: 3.6.8 * NetBox version: 2.6.5 ### Steps to Reproduce 1. Create a custom with logs containing HTML tag-looking data like output of python type() 2. Run the script ``` from extras.scripts import Script class LogBugScript(Script): description = "HTML entities not escaped" def run(self, data): self.log_debug("int type: {}".format(type(2))) self.log_success("int type [fixed]: {}".format(type(2)).replace("<", "<")) self.log_info("<pre>Can be nice</pre>") self.log_warning("<pre>Or not</pre>") self.log_failure("JS injection...<script lang='javascript'>alert('XSS')</script>") ``` ![output](https://user-images.githubusercontent.com/55992072/65899904-04c33b00-e3b5-11e9-8bc0-9363718308c9.jpg)  log_* functions should escape HTML entities  log_* just output passed string as-is avoiding output of some texts and opening possibility of code injection.

adam closed this issue

2025-12-29 18:23:25 +01:00

adam commented

2025-12-29 18:23:25 +01:00

@jeremystretch commented on GitHub (Oct 7, 2019):

Folding this into #3471

@jeremystretch commented on GitHub (Oct 7, 2019): Folding this into #3471

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#2917