Protect against Git-repo jobs clobbering sys.modules

[glennmatthews]

As ...

Patti - Platform Admin

I want ...

To add Jobs via Git repositories without worrying about them impacting the overall stability of the platform.

After #3840 , there is a risk that a misnamed (or maliciously-named) Git repository could potentially clobber existing Python code. For example, creating a repository and assigning it the slug nautobot causes all sorts of havoc as it results in Nautobot unloading itself and then attempting to reimport all of Nautobot's code from the Git repository by that name.

So that ...

The application is resilient to user error as well as mischievous/malicious actions by authenticated users.

I know this is done when...

• Creating a GitRepository whose slug matches any currently loaded Python module in the Nautobot environment is rejected with an appropriate error message.

Optional - Feature groups this request pertains to.

• Automation
• Circuits
• DCIM
• IPAM
• Misc (including Data Sources)
• Organization
• Plugins (and other Extensibility)
• Security (Secrets, etc)
• Image Management
• UI/UX
• Documentation
• Other (not directly a platform feature)

Database Changes

None

External Dependencies

None

[glennmatthews]

As @gsnider2195 pointed out, since we add GIT_ROOT to the end of sys.path, we should also ensure that the git repo slug isn't shadowed by any already-importable module that would come from an earlier sys.path entry (e.g. standard library packages like math or traceback). Possibly importlib.util.find_spec(gitrepo.slug) or similar would be an appropriate check.

[bryanculver]

Add check in clean (see others here:

nautobot/nautobot/extras/models/datasources.py

Lines 81 to 91 in 956c954

	def clean(self):
	super().clean()
	if self.slug != "":
	check_if_key_is_graphql_safe(self.__class__.__name__, self.slug, "slug")
	if self.present_in_database and self.slug != self.__initial_slug:
	raise ValidationError(
	f"Slug cannot be changed once set. Current slug is {self.__initial_slug}, "
	f"requested slug is {self.slug}"
	)

) implementing the above #3859 (comment)

[glennmatthews]

Implemented by #3943.