Repository: netbox-community/netbox

Issue:
Exception with multiselect custom field and query="null"
### NetBox version

v3.5.9

### Python version

3.8

### Steps to Reproduce

1. Create a custom field of type "multiple selection". Let's say it's called "foo" and is applied to dcim.device, and has allowed values "a,b,c"
2. Query `/dcim/devices/?cf_foo=null`

### Expected Behavior

The request to be processed, or at least ignored.  (Ideally it would show devices which have no selection made for the given custom field)

### Observed Behavior

A ValueError was raised.

![image](https://github.com/netbox-community/netbox/assets/44789/a86dc86c-27d2-4edf-a17f-12294fdcd659)

Here is the backtrace:

```
Internal Server Error: /dcim/devices/

ValueError at /dcim/devices/
Cannot use None as a query value

Request Method: GET
Request URL: https://netbox.example.net/dcim/devices/?cf_foo=null
Django Version: 4.1.10
Python Executable: /opt/netbox/venv/bin/python3.8
Python Version: 3.8.10
Python Path: ['/opt/netbox/netbox', '/opt/netbox', '/opt/netbox/venv/bin', '/usr/lib/python38.zip', '/usr/lib/python3.8', '/usr/lib/python3.8/lib-dynload', '/opt/netbox/venv/lib/python3.8/site-packages']
Server time: Wed, 30 Aug 2023 09:43:17 +0000
Installed Applications:
['django.contrib.admin',
 'django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.messages',
 'django.contrib.staticfiles',
 'django.contrib.humanize',
 'corsheaders',
 'debug_toolbar',
 'graphiql_debug_toolbar',
 'django_filters',
 'django_tables2',
 'django_prometheus',
 'graphene_django',
 'mptt',
 'rest_framework',
 'social_django',
 'taggit',
 'timezone_field',
 'core',
 'circuits',
 'dcim',
 'ipam',
 'extras',
 'tenancy',
 'users',
 'utilities',
 'virtualization',
 'wireless',
 'django_rq',
 'drf_spectacular',
 'drf_spectacular_sidecar',
 'netbox_prometheus_sd.PrometheusSD',
 'netbox_topology_views.TopologyViewsConfig']
Installed Middleware:
['graphiql_debug_toolbar.middleware.DebugToolbarMiddleware',
 'django_prometheus.middleware.PrometheusBeforeMiddleware',
 'corsheaders.middleware.CorsMiddleware',
 'django.contrib.sessions.middleware.SessionMiddleware',
 'django.middleware.common.CommonMiddleware',
 'django.middleware.csrf.CsrfViewMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 'django.middleware.security.SecurityMiddleware',
 'netbox.middleware.RemoteUserMiddleware',
 'netbox.middleware.CoreMiddleware',
 'netbox.middleware.MaintenanceModeMiddleware',
 'django_prometheus.middleware.PrometheusAfterMiddleware']


Traceback (most recent call last):
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/core/handlers/exception.py", line 56, in inner
    response = get_response(request)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/core/handlers/base.py", line 197, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/views/generic/base.py", line 103, in view
    return self.dispatch(request, *args, **kwargs)
  File "/opt/netbox/netbox/netbox/views/generic/base.py", line 77, in dispatch
    return super().dispatch(request, *args, **kwargs)
  File "/opt/netbox/netbox/utilities/views.py", line 99, in dispatch
    return super().dispatch(request, *args, **kwargs)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/views/generic/base.py", line 142, in dispatch
    return handler(request, *args, **kwargs)
  File "/opt/netbox/netbox/netbox/views/generic/bulk_views.py", line 130, in get
    self.queryset = self.filterset(request.GET, self.queryset, request=request).qs
  File "/opt/netbox/venv/lib/python3.8/site-packages/django_filters/filterset.py", line 230, in qs
    qs = self.filter_queryset(qs)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django_filters/filterset.py", line 213, in filter_queryset
    queryset = self.filters[name].filter(queryset, value)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django_filters/filters.py", line 263, in filter
    qs = self.get_method(qs)(q)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/query.py", line 1421, in filter
    return self._filter_or_exclude(False, args, kwargs)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/query.py", line 1439, in _filter_or_exclude
    clone._filter_or_exclude_inplace(negate, args, kwargs)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/query.py", line 1446, in _filter_or_exclude_inplace
    self._query.add_q(Q(*args, **kwargs))
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/sql/query.py", line 1532, in add_q
    clause, _ = self._add_q(q_object, self.used_aliases)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/sql/query.py", line 1562, in _add_q
    child_clause, needed_inner = self.build_filter(
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/sql/query.py", line 1388, in build_filter
    return self._add_q(
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/sql/query.py", line 1562, in _add_q
    child_clause, needed_inner = self.build_filter(
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/sql/query.py", line 1478, in build_filter
    condition = self.build_lookup(lookups, col, value)
  File "/opt/netbox/venv/lib/python3.8/site-packages/django/db/models/sql/query.py", line 1308, in build_lookup
    raise ValueError("Cannot use None as a query value")

Exception Type: ValueError at /dcim/devices/
Exception Value: Cannot use None as a query value
Raised during: dcim.views.DeviceListView
Request information:
USER: brian

GET:
cf_foo = 'null'

POST: No POST data

FILES: No FILES data
```

Additional info:
* The queries `cf_foo=null` and `cf_foo__n=null` work with custom fields of type "select" rather than "multiselect"
* With multiselect, the query `cf_foo=a` works as expected
* With multiselect, the query `cf_foo__n=a` does not work (it has no effect, all devices are shown); similarly, `cf_foo__n=null` has no effect.
* Relates to https://github.com/netbox-community/netbox/issues/11538#issuecomment-1635839720



Discussion:
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. **Do not** attempt to circumvent this process by "bumping" the issue; doing so will result in its immediate closure and you may be barred from participating in any future discussions. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).

Resolving patch:
diff --git a/netbox/extras/models/customfields.py b/netbox/extras/models/customfields.py
--- a/netbox/extras/models/customfields.py
+++ b/netbox/extras/models/customfields.py
@@ -10,7 +10,6 @@
 from django.core.validators import RegexValidator, ValidationError
 from django.db import models
 from django.urls import reverse
-from django.utils.html import escape
 from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 
@@ -571,8 +570,7 @@ def to_filter(self, lookup_expr=None):
 
         # Multiselect
         elif self.type == CustomFieldTypeChoices.TYPE_MULTISELECT:
-            filter_class = filters.MultiValueCharFilter
-            kwargs['lookup_expr'] = 'has_key'
+            filter_class = filters.MultiValueArrayFilter
 
         # Object
         elif self.type == CustomFieldTypeChoices.TYPE_OBJECT:
diff --git a/netbox/utilities/filters.py b/netbox/utilities/filters.py
--- a/netbox/utilities/filters.py
+++ b/netbox/utilities/filters.py
@@ -9,6 +9,7 @@
 __all__ = (
     'ContentTypeFilter',
     'MACAddressFilter',
+    'MultiValueArrayFilter',
     'MultiValueCharFilter',
     'MultiValueDateFilter',
     'MultiValueDateTimeFilter',
@@ -85,6 +86,21 @@ class MultiValueTimeFilter(django_filters.MultipleChoiceFilter):
     field_class = multivalue_field_factory(forms.TimeField)
 
 
+@extend_schema_field(OpenApiTypes.STR)
+class MultiValueArrayFilter(django_filters.MultipleChoiceFilter):
+    field_class = multivalue_field_factory(forms.CharField)
+
+    def __init__(self, *args, lookup_expr='contains', **kwargs):
+        # Set default lookup_expr to 'contains'
+        super().__init__(*args, lookup_expr=lookup_expr, **kwargs)
+
+    def get_filter_predicate(self, v):
+        # If filtering for null values, ignore lookup_expr
+        if v is None:
+            return {self.field_name: None}
+        return super().get_filter_predicate(v)
+
+
 class MACAddressFilter(django_filters.CharFilter):
     pass
 


Test patch:
diff --git a/netbox/extras/tests/test_customfields.py b/netbox/extras/tests/test_customfields.py
--- a/netbox/extras/tests/test_customfields.py
+++ b/netbox/extras/tests/test_customfields.py
@@ -1329,7 +1329,7 @@ def setUpTestData(cls):
 
         choice_set = CustomFieldChoiceSet.objects.create(
             name='Custom Field Choice Set 1',
-            extra_choices=(('a', 'A'), ('b', 'B'), ('c', 'C'), ('x', 'X'))
+            extra_choices=(('a', 'A'), ('b', 'B'), ('c', 'C'))
         )
 
         # Integer filtering
@@ -1435,7 +1435,7 @@ def setUpTestData(cls):
                 'cf7': 'http://a.example.com',
                 'cf8': 'http://a.example.com',
                 'cf9': 'A',
-                'cf10': ['A', 'X'],
+                'cf10': ['A', 'B'],
                 'cf11': manufacturers[0].pk,
                 'cf12': [manufacturers[0].pk, manufacturers[3].pk],
             }),
@@ -1449,7 +1449,7 @@ def setUpTestData(cls):
                 'cf7': 'http://b.example.com',
                 'cf8': 'http://b.example.com',
                 'cf9': 'B',
-                'cf10': ['B', 'X'],
+                'cf10': ['B', 'C'],
                 'cf11': manufacturers[1].pk,
                 'cf12': [manufacturers[1].pk, manufacturers[3].pk],
             }),
@@ -1463,7 +1463,7 @@ def setUpTestData(cls):
                 'cf7': 'http://c.example.com',
                 'cf8': 'http://c.example.com',
                 'cf9': 'C',
-                'cf10': ['C', 'X'],
+                'cf10': None,
                 'cf11': manufacturers[2].pk,
                 'cf12': [manufacturers[2].pk, manufacturers[3].pk],
             }),
@@ -1531,8 +1531,9 @@ def test_filter_select(self):
         self.assertEqual(self.filterset({'cf_cf9': ['A', 'B']}, self.queryset).qs.count(), 2)
 
     def test_filter_multiselect(self):
-        self.assertEqual(self.filterset({'cf_cf10': ['A', 'B']}, self.queryset).qs.count(), 2)
-        self.assertEqual(self.filterset({'cf_cf10': ['X']}, self.queryset).qs.count(), 3)
+        self.assertEqual(self.filterset({'cf_cf10': ['A']}, self.queryset).qs.count(), 1)
+        self.assertEqual(self.filterset({'cf_cf10': ['A', 'C']}, self.queryset).qs.count(), 2)
+        self.assertEqual(self.filterset({'cf_cf10': ['null']}, self.queryset).qs.count(), 1)
 
     def test_filter_object(self):
         manufacturer_ids = Manufacturer.objects.values_list('id', flat=True)