hanzoui/custom-nodes-security-scan
1
0
Fork 0
mirror of https://github.com/hanzoui/custom-nodes-security-scan.git synced 2026-10-30 20:56:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
custom-nodes-security-scan/docs/ComfyUI-AnimateDiff-Evolved-bandit.html
T
zeekay 6bdea42e64 rebrand: Hanzo AI Inc — full rebrand from ComfyUI/Comfy-Org 
- Updated copyright to Hanzo AI, Inc.
- Replaced ComfyUI references with Hanzo Studio
- Updated GitHub org URLs (Comfy-Org → hanzoui)
- Updated domains (comfy.org → hanzo.ai)
- Updated package names and npm scopes
- Updated LICENSE with Hanzo AI copyright header
2026-02-23 10:54:25 -08:00

517 lines
19 KiB
HTML
Raw Permalink Blame History

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>
Bandit Report
</title>
<style>
html * {
font-family: "Arial", sans-serif;
}
pre {
font-family: "Monaco", monospace;
}
.bordered-box {
border: 1px solid black;
padding-top:.5em;
padding-bottom:.5em;
padding-left:1em;
}
.metrics-box {
font-size: 1.1em;
line-height: 130%;
}
.metrics-title {
font-size: 1.5em;
font-weight: 500;
margin-bottom: .25em;
}
.issue-description {
font-size: 1.3em;
font-weight: 500;
}
.candidate-issues {
margin-left: 2em;
border-left: solid 1px; LightGray;
padding-left: 5%;
margin-top: .2em;
margin-bottom: .2em;
}
.issue-block {
border: 1px solid LightGray;
padding-left: .5em;
padding-top: .5em;
padding-bottom: .5em;
margin-bottom: .5em;
}
.issue-sev-high {
background-color: Pink;
}
.issue-sev-medium {
background-color: NavajoWhite;
}
.issue-sev-low {
background-color: LightCyan;
}
</style>
</head>
<body>
<div id="metrics">
<div class="metrics-box bordered-box">
<div class="metrics-title">
Metrics:<br>
</div>
Total lines of code: <span id="loc">8043</span><br>
Total lines skipped (#nosec): <span id="nosec">0</span>
</div>
</div>
<br>
<div id="results">
<div id="issue-0">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_animatelcm_i2v.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_animatelcm_i2v.py</a><br>
<b>Line number: </b>77<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
73
74 def set_insertion_weights(self, insertion_weights: list[float]):
75 if insertion_weights is None:
76 insertion_weights = [1.0, 1.0, 1.0, 1.0]
77 assert len(insertion_weights) == 4
78 self.insertion_weights = insertion_weights
79
80 def cleanup(self):
</pre>
</div>
</div>
</div>
<div id="issue-1">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_animatelcm_i2v.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_animatelcm_i2v.py</a><br>
<b>Line number: </b>174<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
170 if use_conv:
171 self.operation = ops.conv_nd(dims, in_channels=self.channels, out_channels=self.out_channels,
172 kernel_size=3, stride=stride, padding=padding)
173 else:
174 assert self.channels == self.out_channels
175 self.operation = avg_pool_nd(dims, kernel_size=stride, stride=stride) # both are stride value on purpose
176
177 def forward(self, x: Tensor):
</pre>
</div>
</div>
</div>
<div id="issue-2">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_animatelcm_i2v.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_animatelcm_i2v.py</a><br>
<b>Line number: </b>178<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
174 assert self.channels == self.out_channels
175 self.operation = avg_pool_nd(dims, kernel_size=stride, stride=stride) # both are stride value on purpose
176
177 def forward(self, x: Tensor):
178 assert x.shape[1] == self.channels
179
180 kernel_size = (2, 2)
181
</pre>
</div>
</div>
</div>
<div id="issue-3">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_cameractrl.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_cameractrl.py</a><br>
<b>Line number: </b>317<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
313 if use_conv:
314 self.operation = ops.conv_nd(dims, in_channels=self.channels, out_channels=self.out_channels,
315 kernel_size=3, stride=stride, padding=padding)
316 else:
317 assert self.channels == self.out_channels
318 self.operation = avg_pool_nd(dims, kernel_size=stride, stride=stride) # both are stride value on purpose
319
320 def forward(self, x: Tensor):
</pre>
</div>
</div>
</div>
<div id="issue-4">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_cameractrl.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/adapter_cameractrl.py</a><br>
<b>Line number: </b>321<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
317 assert self.channels == self.out_channels
318 self.operation = avg_pool_nd(dims, kernel_size=stride, stride=stride) # both are stride value on purpose
319
320 def forward(self, x: Tensor):
321 assert x.shape[1] == self.channels
322 return self.operation(x)
</pre>
</div>
</div>
</div>
<div id="issue-5">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/motion_module_ad.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/motion_module_ad.py</a><br>
<b>Line number: </b>1128<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
1124 *args,
1125 **kwargs,
1126 ):
1127 super().__init__(operations=ops, *args, **kwargs)
1128 assert attention_mode == &quot;Temporal&quot;
1129
1130 self.attention_mode = attention_mode
1131 self.is_cross_attention = kwargs[&quot;context_dim&quot;] is not None
</pre>
</div>
</div>
</div>
<div id="issue-6">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_animatelcmi2v.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_animatelcmi2v.py</a><br>
<b>Line number: </b>148<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
144 # now that images are the expected size, VAEEncode them
145 try: # account for old Hanzo Studio versions (TODO: remove this when other changes require Hanzo Studio update)
146 if not hasattr(vae, &quot;vae_encode_crop_pixels&quot;):
147 image = VAEEncode.vae_encode_crop_pixels(image)
148 except Exception:
149 pass
150 return ({&quot;samples&quot;: vae.encode(image[:,:,:,:3])},)
</pre>
</div>
</div>
</div>
<div id="issue-7">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_cameractrl.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_cameractrl.py</a><br>
<b>Line number: </b>24<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
20
21
22 class CameraMotion:
23 def __init__(self, rotate: tuple[float], translate: tuple[float]):
24 assert len(rotate) == 3
25 assert len(translate) == 3
26 self.rotate = np.array(rotate)
27 self.translate = np.array(translate)
</pre>
</div>
</div>
</div>
<div id="issue-8">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_cameractrl.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_cameractrl.py</a><br>
<b>Line number: </b>25<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
21
22 class CameraMotion:
23 def __init__(self, rotate: tuple[float], translate: tuple[float]):
24 assert len(rotate) == 3
25 assert len(translate) == 3
26 self.rotate = np.array(rotate)
27 self.translate = np.array(translate)
28
</pre>
</div>
</div>
</div>
<div id="issue-9">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_deprecated.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_deprecated.py</a><br>
<b>Line number: </b>4<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1 import json
2 import os
3 import shutil
4 import subprocess
5 from typing import Dict, List
6
7 import numpy as np
8 import torch
</pre>
</div>
</div>
</div>
<div id="issue-10">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_deprecated.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/nodes_deprecated.py</a><br>
<b>Line number: </b>266<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
262
263 env=os.environ.copy()
264 if &quot;environment&quot; in video_format:
265 env.update(video_format[&quot;environment&quot;])
266 with subprocess.Popen(args, stdin=subprocess.PIPE, env=env) as proc:
267 for frame in frames:
268 proc.stdin.write(frame.tobytes())
269
</pre>
</div>
</div>
</div>
<div id="issue-11">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/sampling.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/sampling.py</a><br>
<b>Line number: </b>275<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
271 # if mps device (Apple Silicon), disable batched conds to avoid black images with groupnorm hack
272 try:
273 if model.load_device.type == &quot;mps&quot;:
274 model.model.memory_required = unlimited_memory_required
275 except Exception:
276 pass
277 # if img_encoder or camera_encoder present, inject apply_model to handle correctly
278 for motion_model in model.motion_models:
279 if (motion_model.model.img_encoder is not None) or (motion_model.model.camera_encoder is not None):
</pre>
</div>
</div>
</div>
<div id="issue-12">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/sampling.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/sampling.py</a><br>
<b>Line number: </b>683<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
679 mask_strength = 1.0
680 if &quot;mask_strength&quot; in conds:
681 mask_strength = conds[&quot;mask_strength&quot;]
682 mask = conds[&#x27;mask&#x27;]
683 assert(mask.shape[1] == x_in.shape[2])
684 assert(mask.shape[2] == x_in.shape[3])
685 # make sure mask is capped at input_shape batch length to prevent 0 as dimension
686 mask = mask[:input_x.shape[0], area[2]:area[0] + area[2], area[3]:area[1] + area[3]] * mask_strength
</pre>
</div>
</div>
</div>
<div id="issue-13">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/sampling.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/sampling.py</a><br>
<b>Line number: </b>684<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
680 if &quot;mask_strength&quot; in conds:
681 mask_strength = conds[&quot;mask_strength&quot;]
682 mask = conds[&#x27;mask&#x27;]
683 assert(mask.shape[1] == x_in.shape[2])
684 assert(mask.shape[2] == x_in.shape[3])
685 # make sure mask is capped at input_shape batch length to prevent 0 as dimension
686 mask = mask[:input_x.shape[0], area[2]:area[0] + area[2], area[3]:area[1] + area[3]] * mask_strength
687 mask = mask.unsqueeze(1).repeat(input_x.shape[0] // mask.shape[0], input_x.shape[1], 1, 1)
</pre>
</div>
</div>
</div>
<div id="issue-14">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/utils_model.py" target="_blank">/custom_nodes/Hanzo Studio-AnimateDiff-Evolved/animatediff/utils_model.py</a><br>
<b>Line number: </b>273<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
269
270 def try_mkdir(full_path: str):
271 try:
272 Path(full_path).mkdir()
273 except Exception:
274 pass
275
276
277 # register motion models folder(s)
</pre>
</div>
</div>
</div>
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink