custom-nodes-security-scan/docs/BizyAir-bandit.html

<!DOCTYPE html>
<html>
<head>

<meta charset="UTF-8">

<title>
    Bandit Report
</title>

<style>

html * {
    font-family: "Arial", sans-serif;
}

pre {
    font-family: "Monaco", monospace;
}

.bordered-box {
    border: 1px solid black;
    padding-top:.5em;
    padding-bottom:.5em;
    padding-left:1em;
}

.metrics-box {
    font-size: 1.1em;
    line-height: 130%;
}

.metrics-title {
    font-size: 1.5em;
    font-weight: 500;
    margin-bottom: .25em;
}

.issue-description {
    font-size: 1.3em;
    font-weight: 500;
}

.candidate-issues {
    margin-left: 2em;
    border-left: solid 1px; LightGray;
    padding-left: 5%;
    margin-top: .2em;
    margin-bottom: .2em;
}

.issue-block {
    border: 1px solid LightGray;
    padding-left: .5em;
    padding-top: .5em;
    padding-bottom: .5em;
    margin-bottom: .5em;
}

.issue-sev-high {
    background-color: Pink;
}

.issue-sev-medium {
    background-color: NavajoWhite;
}

.issue-sev-low {
    background-color: LightCyan;
}

</style>
</head>

<body>

<div id="metrics">
    <div class="metrics-box bordered-box">
        <div class="metrics-title">
            Metrics:<br>
        </div>
        Total lines of code: <span id="loc">1066</span><br>
        Total lines skipped (#nosec): <span id="nosec">0</span>
    </div>
</div>




<br>
<div id="results">
    
<div id="issue-0">
<div class="issue-block issue-sev-low">
    <b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
    <b>Test ID:</b> B101<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/kolors.py" target="_blank">/custom_nodes/BizyAir/kolors.py</a><br>
    <b>Line number: </b>46<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>

<div class="code">
<pre>
42	    def encode(self, prompt, negative_prompt, num_images_per_prompt):
43	        API_KEY = get_api_key()
44	        split_pos_text = prompt.split(&quot;|&quot;)
45	        num_prompts = len(split_pos_text)
46	        assert (
47	            num_prompts * num_images_per_prompt &lt;= 4
48	        ), f&quot;The num_prompts*num_images_per_prompt should be less than or equal 4, got {num_prompts}x{num_images_per_prompt}={num_prompts*num_images_per_prompt}, try to reduce the &#x27;|&#x27; or num_images_per_prompt&quot;
49	
50	        payload = {
51	            &quot;positive_prompt&quot;: prompt,
</pre>
</div>


</div>
</div>

<div id="issue-1">
<div class="issue-block issue-sev-low">
    <b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
    <b>Test ID:</b> B101<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/kolors.py" target="_blank">/custom_nodes/BizyAir/kolors.py</a><br>
    <b>Line number: </b>226<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>

<div class="code">
<pre>
222	            &quot;inputs&quot;: None,
223	            &quot;is_compress&quot;: True,
224	        }
225	        if latent is not None:
226	            assert (
227	                latent[&quot;samples&quot;].shape[0] == kolors_embeds[&quot;prompt_embeds&quot;].shape[0]
228	            ), f&quot;The batch size of latent samples should be the same as the prompt_embeds, got {latent[&#x27;samples&#x27;].shape[0]} and {kolors_embeds[&#x27;prompt_embeds&#x27;].shape[0]}&quot;
229	
230	        # convert the tensors to numpy array
231	        np_kolors_embeds = copy.deepcopy(kolors_embeds)
</pre>
</div>


</div>
</div>

<div id="issue-2">
<div class="issue-block issue-sev-low">
    <b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
    <b>Test ID:</b> B101<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/supernode.py" target="_blank">/custom_nodes/BizyAir/supernode.py</a><br>
    <b>Line number: </b>34<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>

<div class="code">
<pre>
30	    def super_resolution(self, image, scale=&quot;2x&quot;):
31	        API_KEY = get_api_key()
32	        device = image.device
33	        _, w, h, c = image.shape
34	        assert (
35	            w &lt;= 512 and h &lt;= 512
36	        ), f&quot;width and height must be less than 512, but got {w} and {h}&quot;
37	
38	        # support RGB mode only now
39	        image = image[:, :, :, :3]
</pre>
</div>


</div>
</div>

<div id="issue-3">
<div class="issue-block issue-sev-low">
    <b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
    <b>Test ID:</b> B101<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/supernode.py" target="_blank">/custom_nodes/BizyAir/supernode.py</a><br>
    <b>Line number: </b>80<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>

<div class="code">
<pre>
76	    def remove_background(self, image):
77	        API_KEY = get_api_key()
78	        device = image.device
79	        _, w, h, _ = image.shape
80	        assert (
81	            w &lt;= 1024 and h &lt;= 1024
82	        ), f&quot;width and height must be less than 1024, but got {w} and {h}&quot;
83	
84	        payload = {
85	            &quot;is_compress&quot;: True,
</pre>
</div>


</div>
</div>

<div id="issue-4">
<div class="issue-block issue-sev-low">
    <b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
    <b>Test ID:</b> B101<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/supernode.py" target="_blank">/custom_nodes/BizyAir/supernode.py</a><br>
    <b>Line number: </b>142<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>

<div class="code">
<pre>
138	    CATEGORY = &quot;☁️BizyAir&quot;
139	
140	    def generate_image(self, prompt, seed, width, height, cfg, batch_size):
141	        API_KEY = get_api_key()
142	        assert (
143	            width &lt;= 1024 and height &lt;= 1024
144	        ), f&quot;width and height must be less than 1024, but got {width} and {height}&quot;
145	
146	        payload = {
147	            &quot;batch_size&quot;: batch_size,
</pre>
</div>


</div>
</div>

<div id="issue-5">
<div class="issue-block issue-sev-low">
    <b>blacklist: </b> Consider possible security implications associated with pickle module.<br>
    <b>Test ID:</b> B403<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/502.html" target="_blank">CWE-502</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/utils.py" target="_blank">/custom_nodes/BizyAir/utils.py</a><br>
    <b>Line number: </b>4<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b403-import-pickle" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b403-import-pickle</a><br>

<div class="code">
<pre>
1	import base64
2	import json
3	import os
4	import pickle
5	import urllib.request
6	import urllib.parse
7	import zlib
8	
</pre>
</div>


</div>
</div>

<div id="issue-6">
<div class="issue-block issue-sev-medium">
    <b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
    <b>Test ID:</b> B310<br>
    <b>Severity: </b>MEDIUM<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/utils.py" target="_blank">/custom_nodes/BizyAir/utils.py</a><br>
    <b>Line number: </b>27<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>

<div class="code">
<pre>
23	    &quot;&quot;&quot;
24	    try:
25	        data = json.dumps(payload).encode(&quot;utf-8&quot;)
26	        req = urllib.request.Request(api_url, data=data, headers=headers, method=&quot;POST&quot;)
27	        with urllib.request.urlopen(req) as response:
28	            response_data = response.read().decode(&quot;utf-8&quot;)
29	        return response_data
30	    except urllib.error.URLError as e:
</pre>
</div>


</div>
</div>

<div id="issue-7">
<div class="issue-block issue-sev-medium">
    <b>blacklist: </b> Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.<br>
    <b>Test ID:</b> B301<br>
    <b>Severity: </b>MEDIUM<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/502.html" target="_blank">CWE-502</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/utils.py" target="_blank">/custom_nodes/BizyAir/utils.py</a><br>
    <b>Line number: </b>94<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b301-pickle" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b301-pickle</a><br>

<div class="code">
<pre>
90	        print(
91	            f&quot;decode_and_deserialize: size of bytes is {format_bytes(len(tensor_bytes))}&quot;
92	        )
93	
94	    deserialized_object = pickle.loads(tensor_bytes)
95	    return deserialized_object
96	
97	
</pre>
</div>


</div>
</div>

<div id="issue-8">
<div class="issue-block issue-sev-low">
    <b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
    <b>Test ID:</b> B101<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/utils.py" target="_blank">/custom_nodes/BizyAir/utils.py</a><br>
    <b>Line number: </b>114<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>

<div class="code">
<pre>
110	        return f&quot;{num_bytes / (1024 * 1024):.2f} MB&quot;
111	
112	
113	def validate_api_key(key: str):
114	    assert isinstance(key, str), f&quot;API_KEY must be a string, got {type(key)}&quot;
115	    assert key.startswith(
116	        &quot;sk&quot;
117	    ), f&quot;invalid key, please refer to https://cloud.siliconflow.cn to get your API_KEY, got {key}&quot;
</pre>
</div>


</div>
</div>

<div id="issue-9">
<div class="issue-block issue-sev-low">
    <b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
    <b>Test ID:</b> B101<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
    <b>File: </b><a href="/custom_nodes/BizyAir/utils.py" target="_blank">/custom_nodes/BizyAir/utils.py</a><br>
    <b>Line number: </b>115<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>

<div class="code">
<pre>
111	
112	
113	def validate_api_key(key: str):
114	    assert isinstance(key, str), f&quot;API_KEY must be a string, got {type(key)}&quot;
115	    assert key.startswith(
116	        &quot;sk&quot;
117	    ), f&quot;invalid key, please refer to https://cloud.siliconflow.cn to get your API_KEY, got {key}&quot;
118	
119	
120	def get_api_key():
</pre>
</div>


</div>
</div>

</div>

</body>
</html>