starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Data Sources | passwords in clear-text #8728

New Issue
Closed
opened 2025-12-29 20:40:26 +01:00 by adam · 3 comments
adam commented 2025-12-29 20:40:26 +01:00
Owner
Copy Link

Originally created by @teixemf on GitHub (Oct 7, 2023).

NetBox version

v3.6.3

Python version

3.11

Steps to Reproduce

  1. Add a new Data Source
  2. Select Type: Git || Amazon S3
  3. Input the Password if Type Git || input the AWS secret access key if Type Amazon S3
  4. Save
  5. Edit the newly added Git || Amazon S3 Data Source
  6. Save
  7. Go to the Data Sources main page showing the all Data Sources table
  8. Configure the table to show the column Parameters

Expected Behavior

  1. While typing the password/AWS secret access key the characters should be masked
  2. After saving, one can see the password/AWS secret access key in clear-text on the Backend card
  3. The password/AWS secret access key should be masked
  4. The password/AWS secret access key should be masked while shown on the Parameters column

Observed Behavior

  1. While typing the password/AWS secret access key the characters appear in clear-text

  2. After saving, one can see the password/AWS secret access key in clear-text on the Backend card

image

image

  1. The password/AWS secret access key should be masked

image

image

  1. The password/AWS secret access key should be masked while shown on the Parameters column

image

Originally created by @teixemf on GitHub (Oct 7, 2023). ### NetBox version v3.6.3 ### Python version 3.11 ### Steps to Reproduce 1. Add a new _Data Source_ 2. Select Type: _Git_ || _Amazon S3_ 3. Input the _Password_ if Type _Git_ || input the _AWS secret access key_ if Type _Amazon S3_ 4. Save 5. Edit the newly added _Git_ || _Amazon S3_ Data Source 6. Save 7. Go to the Data Sources main page showing the all Data Sources table 8. Configure the table to show the column _Parameters_ ### Expected Behavior 3. While typing the _password/AWS secret access key_ the characters should be masked 4. After saving, one can see the _password/AWS secret access key_ in clear-text on the Backend card 5. The _password/AWS secret access key_ should be masked 8. The _password/AWS secret access key_ should be masked while shown on the _Parameters_ column ### Observed Behavior 3. While typing the _password/AWS secret access key_ the characters appear in clear-text 4. After saving, one can see the _password/AWS secret access key_ in clear-text on the Backend card ![image](https://github.com/netbox-community/netbox/assets/816267/bddab6af-2c1e-47c7-a95c-77fbbc3c0e4d) ![image](https://github.com/netbox-community/netbox/assets/816267/e7065f18-9542-48f1-9cf4-deb95fc1c131) 5. The _password/AWS secret access key_ should be masked ![image](https://github.com/netbox-community/netbox/assets/816267/a01cf6d2-ed4b-48d8-8c33-d57964b37cc2) ![image](https://github.com/netbox-community/netbox/assets/816267/9dfcceaf-da94-4644-9302-46eaddbf5fc6) 8. The _password/AWS secret access key_ should be masked while shown on the _Parameters_ column ![image](https://github.com/netbox-community/netbox/assets/816267/5c4d3bde-ef41-41c0-8a29-dbb286a7e5a2)
adam closed this issue 2025-12-29 20:40:26 +01:00
adam commented 2025-12-29 20:40:27 +01:00
Author
Owner
Copy Link

@abhi1693 commented on GitHub (Oct 7, 2023):

I don't think this is a bug. This is somewhat related to #13304, I suspect you are someone with edit access if you are able to view the sensitive parameters as plain text. Moreover, as per #12625 the functionality was requested only for detail object view.

There are other issues I see with this report

  1. You mentioned that the field should display a masked value while typing in the dit form, but that's a standard char field. I don't believe we currently have a password field in the core so not a bug but can be implemented.
  2. Your expected behaviour is to mask the results irrespective of the permission you own, which is essentially a request to change the current behaviour implemented in #12625. So, this is a workflow change rather than a bug also.
  3. You have also asked to mask the values in the table and shown as a bug but this was never implemented as a feature and doesn't even mention this in the documentation.
    I would reclassify this as a feature request instead as this was never released as a core feature.
@abhi1693 commented on GitHub (Oct 7, 2023): I don't think this is a bug. This is somewhat related to #13304, I suspect you are someone with edit access if you are able to view the sensitive parameters as plain text. Moreover, as per #12625 the functionality was requested only for detail object view. There are other issues I see with this report 1. You mentioned that the field should display a masked value while typing in the dit form, but that's a standard char field. I don't believe we currently have a password field in the core so not a bug but can be implemented. 2. Your expected behaviour is to mask the results irrespective of the permission you own, which is essentially a request to change the current behaviour implemented in #12625. So, this is a workflow change rather than a bug also. 3. You have also asked to mask the values in the table and shown as a bug but this was never implemented as a feature and doesn't even mention this in the documentation. I would reclassify this as a feature request instead as this was never released as a core feature.
adam commented 2025-12-29 20:40:28 +01:00
Author
Owner
Copy Link

@teixemf commented on GitHub (Oct 8, 2023):

I don't argue if it can be considered feature request.
I only reported it as a bug based on the behavior of the User form.

In the User form there is also a Password field and that one appears to deal with the password sensitivity correctly.
While adding a password It masks the chars while typing, and it has a field for password input confirmation.
When editing, the password doesn't show up on the screen and it is not rendered in the HTML code.

Bullet 1. appears to be implemented already on the User form:
4286c1cde2/netbox/users/forms/model_forms.py (L166C1-L177C6)

Bullet 2. appears also to be implemented on the User form. No user can see my password. Not even my user. The User can only change it.

Bullet 3. relates to https://github.com/netbox-community/netbox/issues/13729

@teixemf commented on GitHub (Oct 8, 2023): I don't argue if it can be considered feature request. I only reported it as a bug based on the behavior of the User form. In the User form there is also a Password field and that one appears to deal with the password sensitivity correctly. While adding a password It masks the chars while typing, and it has a field for password input confirmation. When editing, the password doesn't show up on the screen and it is not rendered in the HTML code. Bullet 1. appears to be implemented already on the User form: https://github.com/netbox-community/netbox/blob/4286c1cde255a9bf146b3b192e1ac17566af0094/netbox/users/forms/model_forms.py#L166C1-L177C6 Bullet 2. appears also to be implemented on the User form. No user can see my password. Not even my user. The User can only change it. Bullet 3. relates to https://github.com/netbox-community/netbox/issues/13729
adam commented 2025-12-29 20:40:28 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Oct 13, 2023):

I agree with @abhi1693 that none of the behavior mentioned here deviates from expected operation. While I appreciate the need to treat certain data as sensitive, there is a competing need to make it available to enable certain operations and troubleshooting.

@teixemf if you would like to propose a mechanism for omitting potentially sensitive data from the changelog, please submit a feature request detailing both your proposed implementation as well as consideration of the constraints it would impose. Further, if you would like to propose changes to any of the form fields, please submit a separate FR for those.

@jeremystretch commented on GitHub (Oct 13, 2023): I agree with @abhi1693 that none of the behavior mentioned here deviates from expected operation. While I appreciate the need to treat certain data as sensitive, there is a competing need to make it available to enable certain operations and troubleshooting. @teixemf if you would like to propose a mechanism for omitting potentially sensitive data from the changelog, please submit a feature request detailing both your proposed implementation as well as consideration of the constraints it would impose. Further, if you would like to propose changes to any of the form fields, please submit a separate FR for those.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#8728
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?