django-DefectDojo: Endpoint with protocol length > 20 characters causes error in report uploads (Tested with nessus)

When importing an endpoint which has protocol length > 20 characters the import fails

error in UI :

An exception error occurred during the report import:value too long for type character varying(20)

Causes of the problem is a restrictive max_length=20 in the Endpoint model :

class Endpoint(models.Model):
    protocol = models.CharField(null=True, blank=True, max_length=20,
                                 help_text="The communication protocol/scheme such as 'http', 'ftp', 'dns', etc.")

Example string causing error: as seen below the string is 21 chars

fw1-topology-download://xx-0-0-0-0.xx-xx-x.xxx.xxxx

By truncating the endpoint as the example below is possible to upload the Nessus report :

fw1://xx-0-0-0-0.xx-xx-x.xxx.xxxx

Deployment method (select with an X)

  • Docker Compose
  • Kubernetes
  • GoDojo

Logs

                                                                                                                                                                         │
│ uwsgi Traceback (most recent call last):                                                                                                                                                                                                                   │
│ uwsgi   File "/app/./dojo/engagement/views.py", line 602, in import_scan_results                                                                                                                                                                           │
│ uwsgi     test, finding_count, closed_finding_count = importer.import_scan(scan, scan_type, engagement, user, environment, active=active, verified=verified, tags=tags,                                                                                    │
│ uwsgi   File "/app/./dojo/importers/importer/importer.py", line 299, in import_scan                                                                                                                                                                        │
│ uwsgi     new_findings = self.process_parsed_findings(test, parsed_findings, scan_type, user, active,                                                                                                                                                      │
│ uwsgi   File "/app/./dojo/importers/importer/importer.py", line 125, in process_parsed_findings                                                                                                                                                            │
│ uwsgi     ep, created = endpoint_get_or_create(                                                                                                                                                                                                            │
│ uwsgi   File "/app/./dojo/endpoint/utils.py", line 79, in endpoint_get_or_create                                                                                                                                                                           │
│ uwsgi     return Endpoint.objects.get_or_create(**kwargs)                                                                                                                                                                                                  │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/manager.py", line 85, in manager_method                                                                                                                                              │
│ uwsgi     return getattr(self.get_queryset(), name)(*args, **kwargs)                                                                                                                                                                                       │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/tagulous/models/tagged.py", line 238, in get_or_create                                                                                                                                                │
│ uwsgi     return super(TaggedQuerySet, self).get_or_create(**safe_fields)                                                                                                                                                                                  │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/query.py", line 576, in get_or_create                                                                                                                                                │
│ uwsgi     return self._create_object_from_params(kwargs, params)                                                                                                                                                                                           │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/query.py", line 610, in _create_object_from_params                                                                                                                                   │
│ uwsgi     obj = self.create(**params)                                                                                                                                                                                                                      │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/tagulous/models/tagged.py", line 219, in create                                                                                                                                                       │
│ uwsgi     obj = super(TaggedQuerySet, self).create(**safe_fields)                                                                                                                                                                                          │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/query.py", line 447, in create                                                                                                                                                       │
│ uwsgi     obj.save(force_insert=True, using=self.db)                                                                                                                                                                                                       │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/base.py", line 753, in save                                                                                                                                                          │
│ uwsgi     self.save_base(using=using, force_insert=force_insert,                                                                                                                                                                                           │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/base.py", line 790, in save_base                                                                                                                                                     │
│ uwsgi     updated = self._save_table(                                                                                                                                                                                                                      │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/base.py", line 895, in _save_table                                                                                                                                                   │
│ uwsgi     results = self._do_insert(cls._base_manager, using, fields, returning_fields, raw)                                                                                                                                                               │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/base.py", line 933, in _do_insert                                                                                                                                                    │
│ uwsgi     return manager._insert(                                                                                                                                                                                                                          │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/manager.py", line 85, in manager_method                                                                                                                                              │
│ uwsgi     return getattr(self.get_queryset(), name)(*args, **kwargs)                                                                                                                                                                                       │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/query.py", line 1254, in _insert                                                                                                                                                     │
│ uwsgi     return query.get_compiler(using=using).execute_sql(returning_fields)                                                                                                                                                                             │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/models/sql/compiler.py", line 1397, in execute_sql                                                                                                                                          │
│ uwsgi     cursor.execute(sql, params)                                                                                                                                                                                                                      │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/backends/utils.py", line 66, in execute                                                                                                                                                     │
│ uwsgi     return self._execute_with_wrappers(sql, params, many=False, executor=self._execute)                                                                                                                                                              │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/backends/utils.py", line 75, in _execute_with_wrappers                                                                                                                                      │
│ uwsgi     return executor(sql, params, many, context)                                                                                                                                                                                                      │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/backends/utils.py", line 84, in _execute                                                                                                                                                    │
│ uwsgi     return self.cursor.execute(sql, params)                                                                                                                                                                                                          │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/utils.py", line 90, in __exit__                                                                                                                                                             │
│ uwsgi     raise dj_exc_value.with_traceback(traceback) from exc_value                                                                                                                                                                                      │
│ uwsgi   File "/usr/local/lib/python3.8/site-packages/django/db/backends/utils.py", line 84, in _execute                                                                                                                                                    │
│ uwsgi     return self.cursor.execute(sql, params)                              

Screenshot Below image

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Comments: 15 (13 by maintainers)

Most upvoted comments

Hey @kiblik thanks for looking into it. Can’t really share the report as it was for internal things. However the nessus parser in dojo will create an endpoint checking for :

<ReportItem port="264" svc_name="fw1-topology-download" protocol="tcp" severity="0" pluginID="11219" pluginName="Nessus SYN scanner" pluginFamily="Port scanners"> so if you have any report just increase the svc_name length to 21 chars and that will create error.