Fixes #10134: Custom fields data serializer should return a 400 response for invalid data

docs/release-notes/version-3.3.md

@@ -22,6 +22,7 @@
 * [#10108](https://github.com/netbox-community/netbox/issues/10108) - Linkify inside NAT IPs for primary device IPs in UI
 * [#10109](https://github.com/netbox-community/netbox/issues/10109) - Fix available prefixes calculation for container prefixes in the global table
 * [#10111](https://github.com/netbox-community/netbox/issues/10111) - Wrap search QS to catch ValueError on identifier field
+* [#10134](https://github.com/netbox-community/netbox/issues/10134) - Custom fields data serializer should return a 400 response for invalid data
 
 ---
 

netbox/extras/api/customfields.py

@@ -1,5 +1,6 @@
 from django.contrib.contenttypes.models import ContentType
 from rest_framework.fields import Field
+from rest_framework.serializers import ValidationError
 
 from extras.choices import CustomFieldTypeChoices
 from extras.models import CustomField
@@ -62,6 +63,12 @@ class CustomFieldsDataField(Field):
         return data
 
     def to_internal_value(self, data):
+        if type(data) is not dict:
+            raise ValidationError(
+                "Invalid data format. Custom field data must be passed as a dictionary mapping field names to their "
+                "values."
+            )
+
         # If updating an existing instance, start with existing custom_field_data
         if self.parent.instance:
             data = {**self.parent.instance.custom_field_data, **data}