starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Data source username and password are visible in the changelog #8598

New Issue
Closed
opened 2025-12-29 20:38:39 +01:00 by adam · 8 comments
adam commented 2025-12-29 20:38:39 +01:00
Owner
Copy Link

Originally created by @mtbutler07 on GitHub (Sep 8, 2023).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v3.6.1

Feature type

Change to existing functionality

Proposed functionality

When creating a new data source (git) in NetBox with username/password fields populated, a changelog entry is created that contains the diff of the username/password in plain text.

Screenshot from 2023-09-08 13-30-35

This is not ideal for a number of reasons, the primary one being that it exposes credentials to other users that can view the NetBox changelog.

I'm proposing that the the username and password fields be masked or excluded entirely from the changelog entry to prevent exposing credentials.

Use case

It would prevent exposing credentials to other users that are able to view the changelog.

Database changes

No response

External dependencies

No response

Originally created by @mtbutler07 on GitHub (Sep 8, 2023). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v3.6.1 ### Feature type Change to existing functionality ### Proposed functionality When creating a new data source (git) in NetBox with username/password fields populated, a changelog entry is created that contains the diff of the username/password in plain text. ![Screenshot from 2023-09-08 13-30-35](https://github.com/netbox-community/netbox/assets/33135168/2bcf9596-a25b-439c-ae59-691ccda7a633) This is not ideal for a number of reasons, the primary one being that it exposes credentials to other users that can view the NetBox changelog. I'm proposing that the the username and password fields be masked or excluded entirely from the changelog entry to prevent exposing credentials. ### Use case It would prevent exposing credentials to other users that are able to view the changelog. ### Database changes _No response_ ### External dependencies _No response_
adam added the status: acceptedtype: feature labels 2025-12-29 20:38:39 +01:00
adam closed this issue 2025-12-29 20:38:39 +01:00
adam commented 2025-12-29 20:38:40 +01:00
Author
Owner
Copy Link

@mtbutler07 commented on GitHub (Sep 8, 2023):

For the Amazon S3 type, it appears the aws_access_key_id and aws_secret_access_key are also displayed in plain text as well.

@mtbutler07 commented on GitHub (Sep 8, 2023): For the Amazon S3 type, it appears the `aws_access_key_id` and `aws_secret_access_key` are also displayed in plain text as well.
adam commented 2025-12-29 20:38:40 +01:00
Author
Owner
Copy Link

@jsenecal commented on GitHub (Sep 12, 2023):

We probably need a custom method in the serializers for those models to obfuscate specific fields.

@jsenecal commented on GitHub (Sep 12, 2023): We probably need a custom method in the serializers for those models to obfuscate specific fields.
adam commented 2025-12-29 20:38:40 +01:00
Author
Owner
Copy Link

@abhi1693 commented on GitHub (Sep 17, 2023):

We set sensitive_parameters on the DataBackend class, maybe there is a way to call this within the to_objectchange method

2dfbd72f10/netbox/core/data_backends.py (L40)

@abhi1693 commented on GitHub (Sep 17, 2023): We set `sensitive_parameters` on the `DataBackend` class, maybe there is a way to call this within the `to_objectchange` method https://github.com/netbox-community/netbox/blob/2dfbd72f10f8bfddbee3c54a275d73c953d0af4b/netbox/core/data_backends.py#L40
adam commented 2025-12-29 20:38:40 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jan 5, 2024):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Do not attempt to circumvent this process by "bumping" the issue; doing so will result in its immediate closure and you may be barred from participating in any future discussions. Please see our contributing guide.

@github-actions[bot] commented on GitHub (Jan 5, 2024): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. **Do not** attempt to circumvent this process by "bumping" the issue; doing so will result in its immediate closure and you may be barred from participating in any future discussions. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
adam commented 2025-12-29 20:38:40 +01:00
Author
Owner
Copy Link

@jeffgdotorg commented on GitHub (Jan 24, 2024):

This one and feels important enough to rescue, for the sake of our security posture.

@jeffgdotorg commented on GitHub (Jan 24, 2024): This one and feels important enough to rescue, for the sake of our security posture.
adam commented 2025-12-29 20:38:41 +01:00
Author
Owner
Copy Link

@abhi1693 commented on GitHub (Jan 25, 2024):

I'll take a stab at this and see if it's doable

@abhi1693 commented on GitHub (Jan 25, 2024): I'll take a stab at this and see if it's doable
adam commented 2025-12-29 20:38:41 +01:00
Author
Owner
Copy Link

@abhi1693 commented on GitHub (Jan 25, 2024):

I cannot find a way to pop out sensitive parameters from both pre and post change data. The most I was able to do was remove from post change using a hack but it caused slight performance degradation. Maybe another maintainer can help fix this.

@abhi1693 commented on GitHub (Jan 25, 2024): I cannot find a way to pop out sensitive parameters from both pre and post change data. The most I was able to do was remove from post change using a hack but it caused slight performance degradation. Maybe another maintainer can help fix this.
adam commented 2025-12-29 20:38:42 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jan 26, 2024):

Talked about this a bit with @jeffgdotorg this morning. IIRC we have a mechanism in place already to denote sensitive parameters. I'll take a shot at incorporating this into the serialization logic for data sources.

@jeremystretch commented on GitHub (Jan 26, 2024): Talked about this a bit with @jeffgdotorg this morning. IIRC we have a mechanism in place already to denote sensitive parameters. I'll take a shot at incorporating this into the serialization logic for data sources.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#8598
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?