Fixes #20236: Improve file naming and upload handling #1282

New Issue

MrUnknownDE · 2026-04-05T22:55:13+02:00

MrUnknownDE commented

2026-04-05 22:55:13 +02:00

Originally created by @pheus on 9/10/2025

Fixes: #20236

Summary
Silently normalize the on‑disk filename derived from image attachments to prevent nested directories and path traversal, while preserving the user‑entered name in the database/UI unchanged.

What’s changed

In upload_to:
- Normalize browser paths (e.g. C:\fakepath\photo.jpg) and extract the real uploaded extension.
- Use the user‑entered name when present; sanitize via Django’s filename utility.
- Prefix with {object_type.model}_{object_id} and validate the final relative path with validate_file_name(..., allow_relative_path=True).
- Preserve only known image extensions (bmp, gif, jpeg, jpg, png, webp); otherwise save without an extension.
(Hardening) Guard filename parsing to avoid IndexError if older files don’t follow the expected underscore pattern.

Behavior before

Supplying slashes in the name could create subdirectories and trigger IndexError in code that assumes a fixed filename layout.

Behavior after

Files are always stored under image-attachments/ with a flat, safe basename.
The value shown/stored in the name field is not altered; only the on‑disk filename is normalized.

Notes for reviewers

This follows the maintainer guidance to silently normalize rather than reject slashes.
No user‑visible changes to the name field or forms.

*Originally created by @pheus on 9/10/2025* ### Fixes: #20236 **Summary** Silently normalize the **on‑disk filename** derived from image attachments to prevent nested directories and path traversal, while preserving the **user‑entered `name`** in the database/UI unchanged. **What’s changed** - In `upload_to`: - Normalize browser paths (e.g. `C:\fakepath\photo.jpg`) and extract the real uploaded extension. - Use the user‑entered `name` when present; sanitize via Django’s filename utility. - Prefix with `{object_type.model}_{object_id}` and validate the final relative path with `validate_file_name(..., allow_relative_path=True)`. - Preserve only known image extensions (`bmp`, `gif`, `jpeg`, `jpg`, `png`, `webp`); otherwise save without an extension. - (Hardening) Guard filename parsing to avoid `IndexError` if older files don’t follow the expected underscore pattern. **Behavior before** - Supplying slashes in the `name` could create subdirectories and trigger `IndexError` in code that assumes a fixed filename layout. **Behavior after** - Files are always stored under `image-attachments/` with a flat, safe basename. - The value shown/stored in the `name` field is **not altered**; only the on‑disk filename is normalized. **Notes for reviewers** - This follows the maintainer guidance to **silently normalize** rather than reject slashes. - No user‑visible changes to the `name` field or forms.

MrUnknownDE closed this issue

2026-04-05 22:55:13 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#1282