Change models.py and makemigrations - PermissionError: [Errno 13] Permission denied: '/app/dojo/db_migrations/0190_finding_exploit.py'

[breckwoldt]

Hi I would like to add another selection field to the findings. For this I have extended the models.py file:

exploitable = models.BooleanField(default=True,
verbose_name=('Exploitable'),
help_text=("Indicates whether this vulnerability is exploitable or not."))

now if i try to run makemigrations as follows:

"docker-compose exec -it uwsgi ./manage.py makemigrations"

I get the following error message:

Migrations for 'dojo':
dojo/db_migrations/0190_finding_exploit.py
- Add field exploit to finding
Traceback (most recent call last):
File "/app/./manage.py", line 11, in
execute_from_command_line(sys.argv)
File "/usr/local/lib/python3.11/site-packages/django/core/management/init.py", line 446, in execute_from_command_line
utility.execute()
File "/usr/local/lib/python3.11/site-packages/django/core/management/init.py", line 440, in execute
self.fetch_command(subcommand).run_from_argv(self.argv)
File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 402, in run_from_argv
self.execute(*args, **cmd_options)
File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 448, in execute
output = self.handle(*args, **options)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 96, in wrapped
res = handle_func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/django/core/management/commands/makemigrations.py", line 239, in handle
self.write_migration_files(changes)
File "/usr/local/lib/python3.11/site-packages/django/core/management/commands/makemigrations.py", line 279, in write_migration_files
with open(writer.path, "w", encoding="utf-8") as fh:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/app/dojo/db_migrations/0190_finding_exploit.py'

Who can help me?

Best regards

[kiblik]

Have you set env to debug? https://github.com/DefectDojo/django-DefectDojo/blob/master/readme-docs/DOCKER.md#run-with-docker-compose-in-development-mode-with-hot-reloading

[breckwoldt]

Hi thanks for the fast response. Now it´s working. But how can i write the changes in prod?

[kiblik]

I highly recommend do NOT just add a field to your production only for you. Editing data structure (which is not 100% in line with official releases) might be problematic in the future for you if you would like to update the Dojo version.

I thought that you would like to collaborate on the project and you are expecting that if the field is agreed upon by the community, it will be part of the official release.

In my opinion, to have exploitable as a field in finding sounds good. There are scanners which are able to mention

• list of exploits
  

  django-DefectDojo/dojo/tools/nexpose/parser.py

  Lines 153 to 156 in d827299

  	elif item.tag == 'exploits':
  	for exploit in list(item):
  	vuln['refs'][exploit.get('title')] = str(exploit.get('title')).strip() + ' ' + \
  	str(exploit.get('link')).strip()

• or at least exploitability
  

  django-DefectDojo/dojo/tools/blackduck/parser.py

  Line 96 in d827299

  description += "Exploitability: {}\n\n".format(str(i.exploitability))

I would set default=False but in general I suppose this change might be useful for the community.

[manuel-sommer]

@breckwoldt do you want to work on a PR?

[manuel-sommer]

I guess this can be closed @mtesauro

[manuel-sommer]

@mtesauro could you please talk with the other maintainers that you have a workflow to close always the linked issue from PR as soon as you merge a PR? That will keep the issues more clean and up to date in general.