Audit callables available via Custom Script API and apply protections as necessary #1182

New Issue

MrUnknownDE · 2026-04-05T21:31:43+02:00

MrUnknownDE commented

2026-04-05 21:31:43 +02:00

Originally created by @jnovinger on 9/29/2025

Proposed Changes

Audit callable methods, functions, and properties in NetBox core that can be accessed from Jinja2 sandbox environments and add alters_data=True attribute to any that modify database state, alter file-system state, or perform unexpected side effects.

This ensures that methods which alter data or have side effects are explicitly marked with Django's template protection mechanism, preventing accidental calls from Jinja2 sandbox environments (config templates, export templates, webhooks, custom links).

Specific actions:

Review callable methods across NetBox core code that could be accessed via templates:
- Model methods (custom methods beyond Django's auto-protected save/delete)
- Manager methods
- QuerySet methods
- Utility functions accessible in template contexts
- Properties that trigger database writes or external operations
Add alters_data=True to any callable that:
- Modifies database records (create, update, delete operations)
- Performs file system operations (read/write/delete files)
- Makes external API calls or network requests
- Triggers background jobs or tasks
- Modifies cache or session data
- Has any side effects beyond data retrieval/calculation
Focus on methods potentially accessible from template contexts (config templates, export templates,
webhooks, custom links)

Examples:

  def sync_external_data(self):
      # External API calls, file operations, etc.
      pass
  sync_external_data.alters_data = True

  @property
  def refresh_cache(self):
      # Updates cache as side effect
      pass
  refresh_cache.alters_data = True

Justification

While NetBox's current security assessment considers template sandbox access appropriate for users with template permissions, explicitly marking methods with side effects provides defensive security benefits:

Protects against potential changes in Django/Jinja2 behavior that might expose currently-safe methods
Makes it explicit which methods are intended to be unsafe for template contexts
Covers potential side effects in NetBox core
Follows Django's established pattern and extends it systematically
Adds an extra layer of protection complementing existing access controls

*Originally created by @jnovinger on 9/29/2025* ### Proposed Changes Audit callable methods, functions, and properties in NetBox core that can be accessed from Jinja2 sandbox environments and add `alters_data=True` attribute to any that modify database state, alter file-system state, or perform unexpected side effects. This ensures that methods which alter data or have side effects are explicitly marked with Django's template protection mechanism, preventing accidental calls from Jinja2 sandbox environments (config templates, export templates, webhooks, custom links). Specific actions: 1. Review callable methods across NetBox core code that could be accessed via templates: - Model methods (custom methods beyond Django's auto-protected save/delete) - Manager methods - QuerySet methods - Utility functions accessible in template contexts - Properties that trigger database writes or external operations 2. Add alters_data=True to any callable that: - Modifies database records (create, update, delete operations) - Performs file system operations (read/write/delete files) - Makes external API calls or network requests - Triggers background jobs or tasks - Modifies cache or session data - Has any side effects beyond data retrieval/calculation 3. Focus on methods potentially accessible from template contexts (config templates, export templates, webhooks, custom links) Examples: ```py def sync_external_data(self): # External API calls, file operations, etc. pass sync_external_data.alters_data = True @property def refresh_cache(self): # Updates cache as side effect pass refresh_cache.alters_data = True ``` ### Justification While NetBox's current security assessment considers template sandbox access appropriate for users with template permissions, explicitly marking methods with side effects provides defensive security benefits: 1. Protects against potential changes in Django/Jinja2 behavior that might expose currently-safe methods 2. Makes it explicit which methods are intended to be unsafe for template contexts 3. Covers potential side effects in NetBox core 4. Follows Django's established pattern and extends it systematically 5. Adds an extra layer of protection complementing existing access controls

MrUnknownDE closed this issue

2026-04-05 21:31:43 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted status: accepted type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping type: housekeeping

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#1182