New image attachment index breaks if image name contains a slash

[fabi125]

Deployment Type

Self-hosted

NetBox Version

v4.4.0

Python Version

3.12

Steps to Reproduce

1. Go to a random site/rack/device, e.g. https://demo.netbox.dev/dcim/racks/1/
2. Click on "Attach an image"
3. Select a random image and then enter as the name something that contains a slash, e.g. todays date 9/3/25

Expected Behavior

Image gets added or an error is shown that says can't use a slash in the name.

Observed Behavior

<class 'IndexError'>

list index out of range

which comes from here:

  File "/opt/netbox/netbox/extras/models/models.py", line 731, in filename
    return os.path.basename(self.image.name).split('_', 2)[2]
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^
IndexError: list index out of range

The new index and code was added in #18990. This is currently preventing us from upgrading to v4.4 as we seem to have image attachments with slashes in their names in the database and on the filesystem (which are even nested into subfolders oO):

-[ RECORD 3 ]--+-------------------------------------------------------------
id             | 134
object_id      | 12
image          | image-attachments/rack_12_5/31/23.jpg
image_height   | 4032
image_width    | 3024
name           | 5/31/23
created        | 2023-06-01 15:43:29.221191+00
object_type_id | 29
last_updated   | 2023-06-01 15:43:29.221203+00

$ find media/image-attachments/rack_12_5/
media/image-attachments/rack_12_5/
media/image-attachments/rack_12_5/31
media/image-attachments/rack_12_5/31/23.jpg

[bleuchtang]

This issue breaks upgrade to 4.4.0 too:

./upgrade.sh
[...]
  ipam.vrf... Skipping (found 22 existing).                                                                                                                                                                                                                  
  extras.configcontextprofile... No objects found.                                                                            
  extras.customfield... Skipping (found 8 existing).                            
  extras.imageattachment... Traceback (most recent call last):                                                                
  File "/opt/netbox/venv/lib/python3.11/site-packages/django/db/models/options.py", line 683, in get_field                                                                                                                                                   
    return self.fields_map[field_name]                                                                                                                                                                                                                       
           ~~~~~~~~~~~~~~~^^^^^^^^^^^^
KeyError: 'filename' 

During handling of the above exception, another exception occurred:
                                                                                                                              
Traceback (most recent call last):                                                                                                                                                                                                                           
  File "/opt/netbox/netbox/netbox/search/__init__.py", line 108, in to_cache                                                                                                                                                                                 
    type_ = cls.get_field_type(instance, name)                                                                                                                                                                                                               
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                                                                                                                                               
  File "/opt/netbox/netbox/netbox/search/__init__.py", line 51, in get_field_type                                      
    field_cls = instance._meta.get_field(field_name).__class__                                                                                                                                                                                               
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                                                                                                                                         
  File "/opt/netbox/venv/lib/python3.11/site-packages/django/db/models/options.py", line 685, in get_field                                                                                                                                                   
    raise FieldDoesNotExist(                                                                                                  
django.core.exceptions.FieldDoesNotExist: ImageAttachment has no field named 'filename'                                                                                                                                                                      
                                                                                                                              
During handling of the above exception, another exception occurred:                                                                                                                                                                                          
                                                                                                                              
Traceback (most recent call last):
  File "/opt/netbox/netbox/manage.py", line 10, in <module>
    execute_from_command_line(sys.argv)
  File "/opt/netbox/venv/lib/python3.11/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line
    utility.execute()
  File "/opt/netbox/venv/lib/python3.11/site-packages/django/core/management/__init__.py", line 436, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)                                                                   
  File "/opt/netbox/venv/lib/python3.11/site-packages/django/core/management/base.py", line 416, in run_from_argv      
    self.execute(*args, **cmd_options)                                                                                        
  File "/opt/netbox/venv/lib/python3.11/site-packages/django/core/management/base.py", line 460, in execute           
    output = self.handle(*args, **options)                                                                                    
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                    
  File "/opt/netbox/netbox/extras/management/commands/reindex.py", line 96, in handle
    i = search_backend.cache(model.objects.iterator(), remove_existing=False)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/netbox/netbox/search/backends.py", line 220, in cache
    for field in indexer.to_cache(instance, custom_fields=custom_fields):
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/netbox/netbox/search/__init__.py", line 111, in to_cache
    type_ = cls.get_attr_type(instance, name)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^            
  File "/opt/netbox/netbox/netbox/search/__init__.py", line 67, in get_attr_type
    value = getattr(instance, field_name)                                                                                     
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/netbox/netbox/extras/models/models.py", line 731, in filename
    return os.path.basename(self.image.name).split('_', 2)[2]                                                                 
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^                                                                 
IndexError: list index out of range

I was able to run the upgrade normally after changing the image path directly in postgresql and moving the image in media directory.

[DanSheps]

How did you even manage to upload an image with slashes in the name?

[fabi125]

How did you even manage to upload an image with slashes in the name?

As mentioned in my initial bug report, you can specify a name when you upload an image and that gets used as the filename (or directory name in this case, lol):

Steps to Reproduce

1. Go to a random site/rack/device, e.g. https://demo.netbox.dev/dcim/racks/1/

2. Click on "Attach an image"

3. Select a random image and then enter as the name something that contains a slash, e.g. todays date 9/3/25

[DanSheps]

Might need to sanitize that a little better then, lol

[bctiemann]

It "shouldn't" happen — even on a Mac which allows slashes in filenames, NetBox handles the upload fine (by stripping the slashes out); but then on MacOS slashes are stored as : at the Unix layer, and translated to slashes in the UI for tradition's sake.

If slashes do get through one way or another, we should at least be able to handle it gracefully.

[fabi125]

To be extra clear here: the problem here is not the filename of the file that gets uploaded (because slashes either can't exist there or get removed), but rather the name field when you add the field where you can put in whatever your like (incl slashes) which then gets used as the filename for the uploaded image. Surprisingly this even creates needed nested directories if the name contains slashes.

I personally agree that this should be better sanitized and just not allow slashes or the system should use a uuid (or something) for the filename on the disk.

[ljarasius]

I personally agree that this should be better sanitized and just not allow slashes or the system should use a uuid (or something) for the filename on the disk.

I agree with @fabi125 here, these are both quite sane options. Alternatively, there is already an ID in the database for the image attachment that could also be used instead of the name.

[pheus]

I’d like to take this. Could you assign me? Thanks!

I have a tentative fix (sanitize name, replace slashes, normalize in upload_to, and guard the filename parsing), but I’m a bit unsure whether you’d prefer rejecting slashes vs. silently normalizing. Happy to follow your guidance.