Config HTML escape for Comment functions to againiest HTML Injection

[ngocnd1]

Hi anyone,

Does any want using HTML escape for comments functions and do you know where code of function comments config is? I couldnt find it.

[candlerb]

Sorry, can you give an example of what you're trying to do, or what you mean by "HTML escape" in this situation?

For more info on Markdown, this was the original spec: https://daringfireball.net/projects/markdown/syntax - and note that Markdown allows regular HTML tags to be included.

If you want to escape it, e.g. to show <b> literally, then use regular HTML escaping, e.g. < for the less-than sign. Or use markdown features like putting the text between single backticks:

`<b>`

You didn't show which page you're looking at, so I can't point you at the source code. If you're looking at a Device for example, then see netbox/dcim/forms/model_forms.py:

from utilities.forms.fields import (
    CommentField, ContentTypeChoiceField, DynamicModelChoiceField, DynamicModelMultipleChoiceField, JSONField,
    NumericArrayField, SlugField,
)
...
class DeviceForm(TenancyForm, NetBoxModelForm):
...
    comments = CommentField()

...and the source for CommentField is in netbox/utilities/forms/fields/fields.py. It's just an enhanced version of CharField:

from django import forms
...
class CommentField(forms.CharField):
    """
    A textarea with support for Markdown rendering. Exists mostly just to add a standard `help_text`.
    """
    widget = widgets.MarkdownWidget
    help_text = f"""
        <i class="mdi mdi-information-outline"></i>
        <a href="{static('docs/reference/markdown/')}" target="_blank" tabindex="-1">
        Markdown</a> syntax is supported
    """

    def __init__(self, *, help_text=help_text, required=False, **kwargs):
        super().__init__(help_text=help_text, required=required, **kwargs)

[ngocnd1]

Thanks @candlerb for your touch help,
I want to escape it to all page, Do i just need to edit config in netbox/utilities/forms/fields/fields.py? And its can applied to all pages?
And how i config it?
Many thanks!

[candlerb]

I want to escape it to all page

Sorry, I have no idea what that means.

Can you give an example of how you want Netbox to behave, and how it differs from the current behaviour?

[ngocnd1]

Sorry for my short explain @candlerb
Actually what i want is validate input to all string fields. I dont want anyone using html for malicious purposes. Example like below

1. HTML injection

=>For name fields of all pages, If someone put this html code, when we add newsite and going to choose sitegroup then will got that alert.


=> with the comments field of all pages they can insert malicious links

2. Negative value input error
   
   
   => I want to validate for user cannot input negative value, smallest is 1

That 2 issues what i had, could you give me recommendation and where i can fix it and what simplest code is the best way.
I known that features is very useful for us, but in work i want to make it secure.
Have a good day @candlerb

[candlerb]

Check out custom validators:
https://docs.netbox.dev/en/stable/customization/custom-validation/

i want to make it secure

Write-access to Netbox is not something you would give to strangers.

Being able to put HTML in comments is a feature, not a bug. If you don't trust the people who work for you not to abuse your systems, then IMO you should not be giving them any access to your systems (and probably should not be employing them in the first place).

In general though, it should not be possible to raise an exception through user input, such as you saw by setting negative page sizes. I think it is reasonable for you to raise that one as a bug report for insufficient validation.

[ngocnd1]

Check out custom validators: https://docs.netbox.dev/en/stable/customization/custom-validation/

i want to make it secure

Write-access to Netbox is not something you would give to strangers.

Being able to put HTML in comments is a feature, not a bug. If you don't trust the people who work for you not to abuse your systems, then IMO you should not be giving them any access to your systems (and probably should not be employing them in the first place).

many thanks, already see the solution, i knew it is not bug it's feature, just prevent any risk.