nautobot 2.0.4__py3-none-any.whl → 2.1.0b1__py3-none-any.whl

nautobot/extras/tests/test_views.py

@@ -8,6 +8,7 @@ from django.core.exceptions import ValidationError
 from django.test import override_settings
 from django.urls import reverse
 from django.utils import timezone
+from django.utils.html import format_html
 from unittest import mock
 
 from nautobot.core.choices import ColorChoices
@@ -25,12 +26,14 @@ from nautobot.extras.choices import (
 )
 from nautobot.extras.constants import HTTP_CONTENT_TYPE_JSON
 from nautobot.extras.models import (
+    ComputedField,
     ConfigContext,
     ConfigContextSchema,
     CustomField,
     CustomLink,
     DynamicGroup,
     ExportTemplate,
+    ExternalIntegration,
     GitRepository,
     GraphQLQuery,
     Job,
@@ -48,7 +51,6 @@ from nautobot.extras.models import (
     Status,
     Tag,
     Webhook,
-    ComputedField,
 )
 from nautobot.extras.tests.constants import BIG_GRAPHQL_DEVICE_QUERY
 from nautobot.extras.tests.test_relationships import RequiredRelationshipTestMixin
@@ -130,6 +132,63 @@ class ComputedFieldTestCase(
         cls.slug_test_object = "Computed Field Five"
 
 
+class ComputedFieldRenderingTestCase(TestCase):
+    """Tests for the inclusion of ComputedFields, distinct from tests of the ComputedField views themselves."""
+
+    user_permissions = ["dcim.view_locationtype"]
+
+    def setUp(self):
+        super().setUp()
+        self.computedfield = ComputedField(
+            content_type=ContentType.objects.get_for_model(LocationType),
+            key="test",
+            label="Computed Field",
+            template="FOO {{ obj.name }} BAR",
+            fallback_value="Fallback Value",
+            weight=100,
+        )
+        self.computedfield.validated_save()
+        self.location_type = LocationType.objects.get(name="Campus")
+
+    def test_view_object_with_computed_field(self):
+        """Ensure that the computed field template is rendered."""
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertIn(f"FOO {self.location_type.name} BAR", content, content)
+
+    def test_view_object_with_computed_field_fallback_value(self):
+        """Ensure that the fallback_value is rendered if the template fails to render."""
+        # Make the template invalid to demonstrate the fallback value
+        self.computedfield.template = "FOO {{ obj."
+        self.computedfield.validated_save()
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertIn("Fallback Value", content, content)
+
+    def test_view_object_with_computed_field_unsafe_template(self):
+        """Ensure that computed field templates can't be used as an XSS vector."""
+        self.computedfield.template = '<script>alert("Hello world!"</script>'
+        self.computedfield.validated_save()
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+
+    def test_view_object_with_computed_field_unsafe_fallback_value(self):
+        """Ensure that computed field fallback values can't be used as an XSS vector."""
+        self.computedfield.template = "FOO {{ obj."
+        self.computedfield.fallback_value = '<script>alert("Hello world!"</script>'
+        self.computedfield.validated_save()
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+
+
 # TODO: Change base class to PrimaryObjectViewTestCase
 # Blocked by absence of standard create/edit, bulk create views
 class ConfigContextTestCase(
@@ -432,7 +491,9 @@ class CustomFieldTestCase(
         super().test_create_object_with_constrained_permission()
 
 
-class CustomLinkTest(TestCase):
+class CustomLinkRenderingTestCase(TestCase):
+    """Tests for the inclusion of CustomLinks, distinct from tests of the CustomLink views themselves."""
+
     user_permissions = ["dcim.view_location"]
 
     def test_view_object_with_custom_link(self):
@@ -454,6 +515,71 @@ class CustomLinkTest(TestCase):
         content = extract_page_body(response.content.decode(response.charset))
         self.assertIn(f"FOO {location.name} BAR", content, content)
 
+    def test_view_object_with_unsafe_custom_link_text(self):
+        """Ensure that custom links can't be used as a vector for injecting scripts or breaking HTML."""
+        customlink = CustomLink(
+            content_type=ContentType.objects.get_for_model(Location),
+            name="Test",
+            text='<script>alert("Hello world!")</script>',
+            target_url="http://example.com/?location=None",
+            new_window=False,
+        )
+        customlink.validated_save()
+        location_type = LocationType.objects.get(name="Campus")
+        status = Status.objects.get_for_model(Location).first()
+        location = Location(name="Test Location", location_type=location_type, status=status)
+        location.save()
+
+        response = self.client.get(location.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+        self.assertIn(format_html('<a href="{}"', customlink.target_url), content, content)
+
+    def test_view_object_with_unsafe_custom_link_url(self):
+        """Ensure that custom links can't be used as a vector for injecting scripts or breaking HTML."""
+        customlink = CustomLink(
+            content_type=ContentType.objects.get_for_model(Location),
+            name="Test",
+            text="Hello",
+            target_url='"><script>alert("Hello world!")</script><a href="',
+            new_window=False,
+        )
+        customlink.validated_save()
+        location_type = LocationType.objects.get(name="Campus")
+        status = Status.objects.get_for_model(Location).first()
+        location = Location(name="Test Location", location_type=location_type, status=status)
+        location.save()
+
+        response = self.client.get(location.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+        self.assertIn(format_html('<a href="{}"', customlink.target_url), content, content)
+
+    def test_view_object_with_unsafe_custom_link_name(self):
+        """Ensure that custom links can't be used as a vector for injecting scripts or breaking HTML."""
+        customlink = CustomLink(
+            content_type=ContentType.objects.get_for_model(Location),
+            name='<script>alert("Hello World")</script>',
+            text="Hello",
+            target_url="http://example.com/?location={{ obj.name ",  # intentionally bad jinja2 to trigger error case
+            new_window=False,
+        )
+        customlink.validated_save()
+        location_type = LocationType.objects.get(name="Campus")
+        status = Status.objects.get_for_model(Location).first()
+        location = Location(name="Test Location", location_type=location_type, status=status)
+        location.save()
+
+        response = self.client.get(location.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+
 
 class DynamicGroupTestCase(
     ViewTestCases.CreateObjectViewTestCase,
@@ -568,6 +694,25 @@ class ExportTemplateTestCase(
         }
 
 
+class ExternalIntegrationTestCase(ViewTestCases.PrimaryObjectViewTestCase):
+    model = ExternalIntegration
+    bulk_edit_data = {"timeout": 10, "verify_ssl": True, "extra_config": r"{}"}
+    csv_data = (
+        "name,remote_url,verify_ssl,timeout",
+        "Test External Integration 1,https://example.com/test1/,False,10",
+        "Test External Integration 2,https://example.com/test2/,True,20",
+        "Test External Integration 3,https://example.com/test3/,False,30",
+    )
+    form_data = {
+        "name": "Test External Integration",
+        "remote_url": "https://example.com/test1/",
+        "verify_ssl": False,
+        "secrets_group": None,
+        "timeout": 10,
+        "extra_config": '{"foo": "bar"}',
+    }
+
+
 class GitRepositoryTestCase(
     ViewTestCases.BulkDeleteObjectsViewTestCase,
     ViewTestCases.BulkImportObjectsViewTestCase,
@@ -1811,7 +1956,7 @@ class JobTestCase(
         content = extract_page_body(response.content.decode(response.charset))
 
         self.assertHttpStatus(response, 200)
-        self.assertIn(f"<h1>{instance.name} - Change Log</h1>", content)
+        self.assertIn(f"{instance.name} - Change Log", content)
 
 
 class JobButtonTestCase(
@@ -1863,6 +2008,61 @@ class JobButtonTestCase(
         }
 
 
+class JobButtonRenderingTestCase(TestCase):
+    """Tests for the rendering of JobButtons, distinct from tests of the JobButton views themselves."""
+
+    user_permissions = ["dcim.view_locationtype"]
+
+    def setUp(self):
+        super().setUp()
+        self.job_button = JobButton(
+            name="JobButton",
+            text="JobButton {{ obj.name }}",
+            job=Job.objects.get(job_class_name="TestJobButtonReceiverSimple"),
+            confirmation=False,
+        )
+        self.job_button.validated_save()
+        self.job_button.content_types.add(ContentType.objects.get_for_model(LocationType))
+        self.location_type = LocationType.objects.get(name="Campus")
+
+    def test_view_object_with_job_button(self):
+        """Ensure that the job button is rendered."""
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertIn(f"JobButton {self.location_type.name}", content, content)
+
+    def test_view_object_with_unsafe_text(self):
+        """Ensure that JobButton text can't be used as a vector for XSS."""
+        self.job_button.text = '<script>alert("Hello world!")</script>'
+        self.job_button.validated_save()
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+
+        # Make sure grouped rendering is safe too
+        self.job_button.group = '<script>alert("Goodbye")</script>'
+        self.job_button.validated_save()
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+
+    def test_view_object_with_unsafe_name(self):
+        """Ensure that JobButton names can't be used as a vector for XSS."""
+        self.job_button.text = "JobButton {{ obj"
+        self.job_button.name = '<script>alert("Yo")</script>'
+        self.job_button.validated_save()
+        response = self.client.get(self.location_type.get_absolute_url(), follow=True)
+        self.assertEqual(response.status_code, 200)
+        content = extract_page_body(response.content.decode(response.charset))
+        self.assertNotIn("<script>alert", content, content)
+        self.assertIn("&lt;script&gt;alert", content, content)
+
+
 # TODO: Convert to StandardTestCases.Views
 class ObjectChangeTestCase(TestCase):
     user_permissions = ("extras.view_objectchange",)
@@ -2101,7 +2301,7 @@ class RelationshipAssociationTestCase(
             ),
         )
         vlan_status = Status.objects.get_for_model(VLAN).first()
-        vlan_group = VLANGroup.objects.first()
+        vlan_group = VLANGroup.objects.create(name="Test VLANGroup 1")
         vlans = (
             VLAN.objects.create(vid=1, name="VLAN 1", status=vlan_status, vlan_group=vlan_group),
             VLAN.objects.create(vid=2, name="VLAN 2", status=vlan_status, vlan_group=vlan_group),

nautobot/extras/tests/test_webhooks.py

@@ -3,12 +3,14 @@ import uuid
 from copy import deepcopy
 from unittest.mock import patch
 
+from django.apps import apps
 from django.contrib.auth import get_user_model
 from django.contrib.contenttypes.models import ContentType
 from django.utils import timezone
 from requests import Session
 
 from nautobot.core.api.exceptions import SerializerNotFound
+from nautobot.core.api.utils import get_serializer_for_model
 from nautobot.core.testing import APITestCase
 from nautobot.core.utils.lookup import get_changes_for_model
 from nautobot.dcim.api.serializers import LocationSerializer
@@ -17,6 +19,7 @@ from nautobot.extras.choices import ObjectChangeActionChoices
 from nautobot.extras.context_managers import web_request_context
 from nautobot.extras.models import Webhook, Tag
 from nautobot.extras.models.statuses import Status
+from nautobot.extras.registry import registry
 from nautobot.extras.tasks import process_webhook
 from nautobot.extras.utils import generate_signature
 
@@ -100,11 +103,13 @@ class WebhookTest(APITestCase):
         with patch.object(Session, "send", mock_send):
             self.client.force_login(self.user)
 
-            with web_request_context(self.user, change_id=request_id):
+            # create the object to be updated in a separate context
+            with web_request_context(self.user):
                 location_type = LocationType.objects.get(name="Campus")
                 location = Location(name="Location 1", status=self.statuses[0], location_type=location_type)
                 location.save()
 
+            with web_request_context(self.user, change_id=request_id):
                 location.name = "Location Update"
                 location.status = self.statuses[1]
                 location.save()
@@ -213,11 +218,11 @@ class WebhookTest(APITestCase):
                 )
 
     @patch("nautobot.core.api.utils.get_serializer_for_model")
-    def test_webhooks_snapshot_without_model_api_serializer(self, get_serializer_for_model):
+    def test_webhooks_snapshot_without_model_api_serializer(self, mock_get_serializer_for_model):
         def get_serializer(model_class):
             raise SerializerNotFound
 
-        get_serializer_for_model.side_effect = get_serializer
+        mock_get_serializer_for_model.side_effect = get_serializer
 
         request_id = uuid.uuid4()
         webhook = Webhook.objects.get(type_create=True)
@@ -242,11 +247,13 @@ class WebhookTest(APITestCase):
         with patch.object(Session, "send", mock_send):
             self.client.force_login(self.user)
 
-            with web_request_context(self.user, change_id=request_id):
+            # create the object to be updated in a separate context
+            with web_request_context(self.user):
                 location_type = LocationType.objects.get(name="Campus")
                 location = Location(name="Location 1", status=self.statuses[0], location_type=location_type)
                 location.save()
 
+            with web_request_context(self.user, change_id=request_id):
                 location.name = "Location Update"
                 location.status = self.statuses[1]
                 location.save()
@@ -279,18 +286,18 @@ class WebhookTest(APITestCase):
             location = Location(name="Location 1", location_type=location_type, status=self.statuses[0])
             location.save()
 
-            mock_async.assert_called_once()
-            args = mock_async.call_args[1]["args"]
-            self.assertEqual(args[0], Webhook.objects.get(type_create=True).pk)
-            self.assertEqual(args[1]["name"], "Location 1")
-            self.assertEqual(args[2], "location")
-            self.assertEqual(args[3], ObjectChangeActionChoices.ACTION_CREATE)
-            self.assertEqual(args[5], self.user.username)
-            self.assertEqual(args[6], request_id)
-            self.assertEqual(args[7]["prechange"], None)
-            self.assertEqual(args[7]["postchange"]["name"], "Location 1")
-            self.assertEqual(args[7]["differences"]["removed"], None)
-            self.assertEqual(args[7]["differences"]["added"]["name"], "Location 1")
+        mock_async.assert_called_once()
+        args = mock_async.call_args[1]["args"]
+        self.assertEqual(args[0], Webhook.objects.get(type_create=True).pk)
+        self.assertEqual(args[1]["name"], "Location 1")
+        self.assertEqual(args[2], "location")
+        self.assertEqual(args[3], ObjectChangeActionChoices.ACTION_CREATE)
+        self.assertEqual(args[5], self.user.username)
+        self.assertEqual(args[6], request_id)
+        self.assertEqual(args[7]["prechange"], None)
+        self.assertEqual(args[7]["postchange"]["name"], "Location 1")
+        self.assertEqual(args[7]["differences"]["removed"], None)
+        self.assertEqual(args[7]["differences"]["added"]["name"], "Location 1")
 
     @patch("nautobot.extras.tasks.process_webhook.apply_async")
     def test_enqueue_webhooks_m2m_update(self, mock_async):
@@ -314,12 +321,41 @@ class WebhookTest(APITestCase):
         with web_request_context(self.user, change_id=request_id):
             location.tags.add(tag)
 
-            mock_async.assert_called_once()
-            args = mock_async.call_args[1]["args"]
-            self.assertEqual(args[0], Webhook.objects.get(type_update=True).pk)
-            self.assertEqual(args[1]["name"], "Location 1")
-            self.assertEqual(args[2], "location")
-            self.assertEqual(args[3], ObjectChangeActionChoices.ACTION_UPDATE)
-            self.assertEqual(args[5], self.user.username)
-            self.assertEqual(args[6], request_id)
-            self.assertNotEqual(args[7], {})
+        mock_async.assert_called_once()
+        args = mock_async.call_args[1]["args"]
+        self.assertEqual(args[0], Webhook.objects.get(type_update=True).pk)
+        self.assertEqual(args[1]["name"], "Location 1")
+        self.assertEqual(args[2], "location")
+        self.assertEqual(args[3], ObjectChangeActionChoices.ACTION_UPDATE)
+        self.assertEqual(args[5], self.user.username)
+        self.assertEqual(args[6], request_id)
+        self.assertNotEqual(args[7], {})
+
+    @patch("nautobot.extras.context_managers.enqueue_webhooks")
+    def test_enqueue_webhooks_create_update(self, mock_enqueue_webhooks):
+        """
+        Make sure only one webhook is enqueued if there's a create and update in the same change context.
+        """
+        location_type = LocationType.objects.get(name="Campus")
+
+        with web_request_context(self.user):
+            location = Location(name="Location 1", location_type=location_type, status=self.statuses[0])
+            location.save()
+            location.description = "changed"
+            location.save()
+
+        all_changes = get_changes_for_model(location)
+        self.assertEqual(all_changes.count(), 1)
+        mock_enqueue_webhooks.assert_called_once_with(all_changes.first())
+
+    def test_all_webhook_supported_models(self):
+        """
+        Assert that all models registered to support webhooks also support change logging
+        and have an API serializer.
+        """
+
+        for app_label, models in registry["model_features"]["webhooks"].items():
+            for model_name in models:
+                model_class = apps.get_model(app_label, model_name)
+                get_serializer_for_model(model_class)
+                self.assertTrue(hasattr(model_class, "to_objectchange"))

nautobot/extras/urls.py

@@ -26,6 +26,7 @@ from nautobot.extras.models import (
 app_name = "extras"
 
 router = NautobotUIViewSetRouter()
+router.register("external-integrations", views.ExternalIntegrationUIViewSet)
 router.register("job-buttons", views.JobButtonUIViewSet)
 router.register("roles", views.RoleUIViewSet)
 

nautobot/extras/views.py

@@ -13,9 +13,8 @@ from django.shortcuts import get_object_or_404, redirect, render
 from django.template.loader import TemplateDoesNotExist, get_template
 from django.urls import reverse
 from django.utils import timezone
-from django.utils.html import escape
+from django.utils.html import format_html
 from django.utils.http import is_safe_url
-from django.utils.safestring import mark_safe
 from django.views.generic import View
 from django_tables2 import RequestConfig
 from jsonschema.validators import Draft7Validator
@@ -59,6 +58,7 @@ from .models import (
     CustomLink,
     DynamicGroup,
     ExportTemplate,
+    ExternalIntegration,
     GitRepository,
     GraphQLQuery,
     ImageAttachment,
@@ -414,10 +414,10 @@ class CustomFieldEditView(generic.ObjectEditView):
                 msg = f"{verb} {self.queryset.model._meta.verbose_name}"
                 logger.info(f"{msg} {obj} (PK: {obj.pk})")
                 if hasattr(obj, "get_absolute_url"):
-                    msg = f'{msg} <a href="{obj.get_absolute_url()}">{escape(obj)}</a>'
+                    msg = format_html('{} <a href="{}">{}</a>', msg, obj.get_absolute_url(), obj)
                 else:
-                    msg = f"{msg} {escape(obj)}"
-                messages.success(request, mark_safe(msg))
+                    msg = format_html("{} {}", msg, obj)
+                messages.success(request, msg)
 
                 if "_addanother" in request.POST:
                     # If the object has clone_fields, pre-populate a new instance of the form
@@ -652,10 +652,10 @@ class DynamicGroupEditView(generic.ObjectEditView):
                 msg = f"{verb} {self.queryset.model._meta.verbose_name}"
                 logger.info(f"{msg} {obj} (PK: {obj.pk})")
                 if hasattr(obj, "get_absolute_url"):
-                    msg = f'{msg} <a href="{obj.get_absolute_url()}">{escape(obj)}</a>'
+                    msg = format_html('{} <a href="{}">{}</a>', msg, obj.get_absolute_url(), obj)
                 else:
-                    msg = f"{msg} {escape(obj)}"
-                messages.success(request, mark_safe(msg))
+                    msg = format_html("{} {}", msg, obj)
+                messages.success(request, msg)
 
                 if "_addanother" in request.POST:
                     # If the object has clone_fields, pre-populate a new instance of the form
@@ -793,6 +793,20 @@ class ExportTemplateBulkDeleteView(generic.BulkDeleteView):
     table = tables.ExportTemplateTable
 
 
+#
+# External integrations
+#
+
+
+class ExternalIntegrationUIViewSet(NautobotUIViewSet):
+    bulk_update_form_class = forms.ExternalIntegrationBulkEditForm
+    filterset_class = filters.ExternalIntegrationFilterSet
+    form_class = forms.ExternalIntegrationForm
+    queryset = ExternalIntegration.objects.select_related("secrets_group")
+    serializer_class = serializers.ExternalIntegrationSerializer
+    table_class = tables.ExternalIntegrationTable
+
+
 #
 # Git repositories
 #
@@ -1562,8 +1576,8 @@ class JobButtonRunView(ObjectPermissionRequiredMixin, View):
             object_pk=post_data["object_pk"],
             object_model_name=post_data["object_model_name"],
         )
-        msg = f'Job enqueued. <a href="{result.get_absolute_url()}">Click here for the results.</a>'
-        messages.info(request=request, message=mark_safe(msg))
+        msg = format_html('Job enqueued. <a href="{}">Click here for the results.</a>', result.get_absolute_url())
+        messages.info(request=request, message=msg)
         return redirect(post_data["redirect_path"])
 
 
@@ -2037,10 +2051,10 @@ class SecretsGroupEditView(generic.ObjectEditView):
                 msg = f"{verb} {self.queryset.model._meta.verbose_name}"
                 logger.info(f"{msg} {obj} (PK: {obj.pk})")
                 if hasattr(obj, "get_absolute_url"):
-                    msg = f'{msg} <a href="{obj.get_absolute_url()}">{escape(obj)}</a>'
+                    msg = format_html('{} <a href="{}">{}</a>', msg, obj.get_absolute_url(), obj)
                 else:
-                    msg = f"{msg} {escape(obj)}"
-                messages.success(request, mark_safe(msg))
+                    msg = format_html("{} {}", msg, obj)
+                messages.success(request, msg)
 
                 if "_addanother" in request.POST:
                     # If the object has clone_fields, pre-populate a new instance of the form

nautobot/extras/webhooks.py

@@ -1,56 +1,47 @@
-from django.contrib.contenttypes.models import ContentType
 from django.utils import timezone
 
-
-from nautobot.core.api.utils import get_serializer_for_model
-from nautobot.core.utils.lookup import get_changes_for_model
+from nautobot.extras.choices import ObjectChangeActionChoices
 from nautobot.extras.models import Webhook
 from nautobot.extras.registry import registry
 from nautobot.extras.tasks import process_webhook
-from .choices import ObjectChangeActionChoices
 
 
-def enqueue_webhooks(instance, user, request_id, action):
+def enqueue_webhooks(object_change):
     """
     Find Webhook(s) assigned to this instance + action and enqueue them
     to be processed
     """
     # Determine whether this type of object supports webhooks
-    app_label = instance._meta.app_label
-    model_name = instance._meta.model_name
+    app_label = object_change.changed_object_type.app_label
+    model_name = object_change.changed_object_type.model
     if model_name not in registry["model_features"]["webhooks"].get(app_label, []):
         return
 
     # Retrieve any applicable Webhooks
-    content_type = ContentType.objects.get_for_model(instance)
+    content_type = object_change.changed_object_type
     action_flag = {
         ObjectChangeActionChoices.ACTION_CREATE: "type_create",
         ObjectChangeActionChoices.ACTION_UPDATE: "type_update",
         ObjectChangeActionChoices.ACTION_DELETE: "type_delete",
-    }[action]
+    }[object_change.action]
     webhooks = Webhook.objects.filter(content_types=content_type, enabled=True, **{action_flag: True})
 
     if webhooks.exists():
-        # Get the Model's API serializer class and serialize the object
-        serializer_class = get_serializer_for_model(instance.__class__)
-        serializer_context = {
-            "request": None,
-            "depth": 1,
-        }
-        serializer = serializer_class(instance, context=serializer_context)
-        most_recent_change = get_changes_for_model(instance).first()
-        snapshots = most_recent_change.get_snapshots() if most_recent_change else {}
+        # fall back to object_data if object_data_v2 is not available
+        serialized_data = object_change.object_data_v2
+        if serialized_data is None:
+            serialized_data = object_change.object_data
 
         # Enqueue the webhooks
         for webhook in webhooks:
             args = [
                 webhook.pk,
-                serializer.data,
-                instance._meta.model_name,
-                action,
+                serialized_data,
+                model_name,
+                object_change.action,
                 str(timezone.now()),
-                user.username,
-                request_id,
-                snapshots,
+                object_change.user_name,
+                object_change.request_id,
+                object_change.get_snapshots(),
             ]
             process_webhook.apply_async(args=args)

nautobot/ipam/fields.py

@@ -88,6 +88,11 @@ class VarbinaryIPField(models.BinaryField):
         defaults.update(kwargs)
         return super().formfield(*args, **defaults)
 
+    def get_default(self):
+        value = super().get_default()
+        # Prevent None or "" values from being represented as b''
+        return None if value in self.empty_values else value
+
 
 VarbinaryIPField.register_lookup(lookups.IExact)
 VarbinaryIPField.register_lookup(lookups.EndsWith)

nautobot/ipam/forms.py

@@ -75,6 +75,22 @@ class NamespaceForm(LocatableModelFormMixin, NautobotModelForm):
         fields = ["name", "description", "location"]
 
 
+class NamespaceBulkEditForm(
+    TagsBulkEditFormMixin,
+    LocatableModelBulkEditFormMixin,
+    NautobotBulkEditForm,
+):
+    pk = forms.ModelMultipleChoiceField(queryset=Namespace.objects.all(), widget=forms.MultipleHiddenInput())
+    description = forms.CharField(max_length=200, required=False)
+
+    class Meta:
+        model = Namespace
+        nullable_fields = [
+            "description",
+            "location",
+        ]
+
+
 #
 # VRFs
 #