starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

When querying objects via API, Netbox would return the whole list if the object doesn't have that field in its attributes. #3537

New Issue
Closed
opened 2025-12-29 18:29:45 +01:00 by adam · 1 comment
adam commented 2025-12-29 18:29:45 +01:00
Owner
Copy Link

Originally created by @drixo on GitHub (Apr 2, 2020).

Environment

  • Python version: 3.5
  • NetBox version: 2.7.8

I'm not sure if this is a bug or not, but anyways I wanted to give you a warning.

I needed to remove several sites and its inventory (Racks, Devices, Cables, etc.), as this cannot be done in the UI I started working on a script to delete any objects related to the site_id via API.

So I'm basically getting lists of the different components filtering by site_id, for example for devices

https://netbox.my.local:443/api/dcim/devices/?site_id=114

then proceed to delete whatever is in the list, however I noticed that when I filter objects that doesn't have site_id in their attributes I would get the whole list of objects, like for example IP-Addressses

https://netbox.my.local:443/api/ipam/ip-addresses/?site_id=114

This would return the whole list of IPs in IPAM. which can be dangerous given that a wrong field name can make you do stuff in bulk on an undesirable group of objects.

Steps to Reproduce

  1. curl -H "Authorization: Token **********************" -H "Accept: application/json; indent=4" https://netbox.my.local:443/api/ipam/ip-addresses/?site_id=114

Expected Behavior

Should return an empty list or an error

Observed Behavior

Returns the whole list of objects

Originally created by @drixo on GitHub (Apr 2, 2020). <!-- NOTE: IF YOUR ISSUE DOES NOT FOLLOW THIS TEMPLATE, IT WILL BE CLOSED. This form is only for reproducible bugs. If you need assistance with NetBox installation, or if you have a general question, DO NOT open an issue. Instead, post to our mailing list: https://groups.google.com/forum/#!forum/netbox-discuss Please describe the environment in which you are running NetBox. Be sure that you are running an unmodified instance of the latest stable release before submitting a bug report. --> ### Environment * Python version: 3.5 <!-- Example: 3.6.9 --> * NetBox version: 2.7.8 <!-- Example: 2.7.3 --> I'm not sure if this is a bug or not, but anyways I wanted to give you a warning. I needed to remove several sites and its inventory (Racks, Devices, Cables, etc.), as this cannot be done in the UI I started working on a script to delete any objects related to the site_id via API. So I'm basically getting lists of the different components filtering by site_id, for example for devices https://netbox.my.local:443/api/dcim/devices/?site_id=114 then proceed to delete whatever is in the list, however I noticed that when I filter objects that doesn't have site_id in their attributes I would get the whole list of objects, like for example IP-Addressses https://netbox.my.local:443/api/ipam/ip-addresses/?site_id=114 This would return the whole list of IPs in IPAM. which can be dangerous given that a wrong field name can make you do stuff in bulk on an undesirable group of objects. <!-- --> ### Steps to Reproduce 1. curl -H "Authorization: Token **********************" -H "Accept: application/json; indent=4" https://netbox.my.local:443/api/ipam/ip-addresses/?site_id=114 2. 3. <!-- What did you expect to happen? --> ### Expected Behavior Should return an empty list or an error <!-- What happened instead? --> ### Observed Behavior Returns the whole list of objects
adam closed this issue 2025-12-29 18:29:45 +01:00
adam commented 2025-12-29 18:29:46 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Apr 2, 2020):

however I noticed that when I filter objects that doesn't have site_id in their attributes I would get the whole list of objects, like for example IP-Addressses

site_id is not a valid filter for IP addresses, so it is ignored. This is expected.

@jeremystretch commented on GitHub (Apr 2, 2020): > however I noticed that when I filter objects that doesn't have site_id in their attributes I would get the whole list of objects, like for example IP-Addressses `site_id` is not a valid filter for IP addresses, so it is ignored. This is expected.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#3537
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?