From 21f4761335570d06c76294d88905211e4cf2eb20 Mon Sep 17 00:00:00 2001
From: Arthur Hanson <worldnomad@gmail.com>
Date: Fri, 12 May 2023 13:08:57 -0700
Subject: [PATCH] 12468 disallow double underscores in custom field names
 (#12523)

* 12468 disallow double underscores in custom field names

* 12468 disallow double underscores in custom field names

* 12468 review changes

* 12468 correct migration

* 12468 use inverse match

* 12468 use inverse match

* Add test for invalid custom field names

---------

Co-authored-by: jeremystretch <jstretch@netboxlabs.com>
---
 .../0066_customfield_name_validation.py        | 18 +++++++++++++++++-
 netbox/extras/models/customfields.py           |  6 ++++++
 netbox/extras/tests/test_customfields.py       | 11 +++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/netbox/extras/migrations/0066_customfield_name_validation.py b/netbox/extras/migrations/0066_customfield_name_validation.py
index 7a768c10c..3d2c51399 100644
--- a/netbox/extras/migrations/0066_customfield_name_validation.py
+++ b/netbox/extras/migrations/0066_customfield_name_validation.py
@@ -13,6 +13,22 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='customfield',
             name='name',
-            field=models.CharField(max_length=50, unique=True, validators=[django.core.validators.RegexValidator(flags=re.RegexFlag['IGNORECASE'], message='Only alphanumeric characters and underscores are allowed.', regex='^[a-z0-9_]+$')]),
+            field=models.CharField(
+                max_length=50,
+                unique=True,
+                validators=[
+                    django.core.validators.RegexValidator(
+                        flags=re.RegexFlag['IGNORECASE'],
+                        message='Only alphanumeric characters and underscores are allowed.',
+                        regex='^[a-z0-9_]+$',
+                    ),
+                    django.core.validators.RegexValidator(
+                        flags=re.RegexFlag['IGNORECASE'],
+                        inverse_match=True,
+                        message='Double underscores are not permitted in custom field names.',
+                        regex=r'__',
+                    ),
+                ],
+            ),
         ),
     ]
diff --git a/netbox/extras/models/customfields.py b/netbox/extras/models/customfields.py
index 439d15edc..be3540f08 100644
--- a/netbox/extras/models/customfields.py
+++ b/netbox/extras/models/customfields.py
@@ -85,6 +85,12 @@ class CustomField(CloningMixin, ExportTemplatesMixin, ChangeLoggedModel):
                 message="Only alphanumeric characters and underscores are allowed.",
                 flags=re.IGNORECASE
             ),
+            RegexValidator(
+                regex=r'__',
+                message="Double underscores are not permitted in custom field names.",
+                flags=re.IGNORECASE,
+                inverse_match=True
+            ),
         )
     )
     label = models.CharField(
diff --git a/netbox/extras/tests/test_customfields.py b/netbox/extras/tests/test_customfields.py
index 6a3a3d074..3fd0dc83e 100644
--- a/netbox/extras/tests/test_customfields.py
+++ b/netbox/extras/tests/test_customfields.py
@@ -29,6 +29,17 @@ class CustomFieldTest(TestCase):
 
         cls.object_type = ContentType.objects.get_for_model(Site)
 
+    def test_invalid_name(self):
+        """
+        Try creating a CustomField with an invalid name.
+        """
+        with self.assertRaises(ValidationError):
+            # Invalid character
+            CustomField(name='?', type=CustomFieldTypeChoices.TYPE_TEXT).full_clean()
+        with self.assertRaises(ValidationError):
+            # Double underscores not permitted
+            CustomField(name='foo__bar', type=CustomFieldTypeChoices.TYPE_TEXT).full_clean()
+
     def test_text_field(self):
         value = 'Foobar!'