nautobot 1.6.28__py3-none-any.whl → 1.6.29__py3-none-any.whl

nautobot/core/apps/__init__.py

@@ -691,6 +691,24 @@ class CoreConfig(NautobotConfig):
 
         monkey_mix(TaggableManager, mixins.TaggableManagerMonkeyMixin)
 
+        # The code block below is to address an issue describe in https://www.cvedetails.com/cve/CVE-2024-42005/
+        # An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.
+        # QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection
+        # in column aliases via a crafted JSON object key as a passed *arg.
+        # The fix in Django 4.2 https://github.com/django/django/commit/f4af67b9b41e0f4c117a8741da3abbd1c869ab28/
+        # is backported here to Nautobot v1.6.x running on Django 3.2.
+        from django.db.models.sql.query import Query
+
+        Query._set_values = Query.set_values
+
+        def set_values(self, fields):
+            if fields:
+                for field in fields:
+                    self.check_alias(field)
+            self._set_values(fields)
+
+        Query.set_values = set_values
+
 
 class NautobotConstanceConfig(ConstanceConfig):
     """Override "Constance" app name to "Configuration"."""

nautobot/core/tests/test_models.py

@@ -4,7 +4,8 @@ from unittest.mock import patch
 
 from django.core.cache import cache
 from django.core.exceptions import ValidationError
-from django.test import override_settings
+from django.db import models
+from django.test import override_settings, skipUnlessDBFeature
 
 from nautobot.core.models import BaseModel
 from nautobot.utilities.testing import TestCase
@@ -15,6 +16,12 @@ class BaseModelTest(TestCase):
         def clean(self):
             raise ValidationError("validation error")
 
+    class JSONFieldModel(BaseModel):
+        data = models.JSONField(null=True)
+
+        class Meta:
+            required_db_features = {"supports_json_field"}
+
     def test_validated_save_calls_full_clean(self):
         with self.assertRaises(ValidationError):
             self.FakeBaseModel().validated_save()
@@ -61,3 +68,12 @@ class BaseModelTest(TestCase):
             self.FakeBaseModel._content_type_cached
             self.FakeBaseModel._content_type_cached
             self.assertEqual(mock__content_type.call_count, 2)
+
+    @skipUnlessDBFeature("supports_json_field")
+    def test_values_expression_alias_sql_injection_json_field(self):
+        crafted_alias = """injected_name" from "expressions_company"; --"""
+        msg = "Column aliases cannot contain whitespace characters, quotation marks, semicolons, or SQL comments."
+        with self.assertRaisesMessage(ValueError, msg):
+            self.JSONFieldModel.objects.values(f"data__{crafted_alias}")
+        with self.assertRaisesMessage(ValueError, msg):
+            self.JSONFieldModel.objects.values_list(f"data__{crafted_alias}")

nautobot/dcim/views.py

@@ -2257,7 +2257,7 @@ class DeviceBayPopulateView(generic.ObjectEditView):
                 f"Added {device_bay.installed_device} to {device_bay}.",
             )
 
-            return redirect("dcim:device", pk=device_bay.device.pk)
+            return redirect("dcim:device_devicebays", pk=device_bay.device.pk)
 
         return render(
             request,
@@ -2300,7 +2300,7 @@ class DeviceBayDepopulateView(generic.ObjectEditView):
                 f"Removed {removed_device} from {device_bay}.",
             )
 
-            return redirect("dcim:device", pk=device_bay.device.pk)
+            return redirect("dcim:device_devicebays", pk=device_bay.device.pk)
 
         return render(
             request,