FileVar uploads collide with REST run parameters

Closed
  • Is something wrong?
#73 1 comment 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@pheus is already working on this.

Since Nov 3, 2026.

  • #105 by @pheus — merged

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
56/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
api

Research direction

Start at the REST run endpoint's multipart request handling and trace how uploaded file parts are separated from execution parameters. The report reproduces collisions for FileVar names commit and data; use its documented multipart requests to check both cases. Done means the endpoint accepts those uploads as variables, keeps run settings separate, and returns HTTP 201 with the file available to the Script.

Written by the indexing model from the issue text.

Description

app: scripts severity: medium status: accepted type: bug
Plugin Version

v0.0.1

NetBox Version

v4.7.3

Python Version

3.12

Steps to Reproduce
  1. Create a Script Project for uploaded files, upload the following Script, and activate its revision: 
    from netbox_scripts.scripts import FileVar, Script


class TakesNamedFile(Script):
    commit = FileVar(label='Named file')

    def run(self, data, commit):
        return data['commit'].read().decode()
  2. Create a small notes.txt file and request a run using the documented multipart format. Replace <id> with the Script's ID: 
    printf 'hello\n' > notes.txt

curl -i -sS -X POST \
  -H "Authorization: Token $NETBOX_TOKEN" \
  -F 'data={}' \
  -F [email protected] \
  'https://netbox.example.com/api/plugins/netbox-scripts/scripts/<id>/run/'
Expected Behavior

The request returns HTTP 201 and queues the Script with the uploaded file in data['commit']. The file variable is kept separate from the run's commit setting.

The REST execution guide documents file parts named after their variables and separates variable values from execution parameters.

Observed Behavior

The request returns HTTP 400:

{"commit": ["Must be a valid boolean."]}

A FileVar named data, sent alongside the JSON data part, similarly returns:

{"data": ["Value must be valid JSON."]}

The endpoint reads the uploaded file as the top-level run parameter with the same name.

This affects request handling and is separate from the OpenAPI schema change in #16.

Dominant language
Python
Stars
8
Forks
0
Avg merge
9h 34m
Merged PRs (30d)
32

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from netbox-community/netbox-scripts

All issues in netbox-community/netbox-scripts

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.