Files
custom-nodes-security-scan/docs/ComfyUI-Impact-Pack-bandit.html
zeekay 6bdea42e64 rebrand: Hanzo AI Inc — full rebrand from ComfyUI/Comfy-Org
- Updated copyright to Hanzo AI, Inc.
- Replaced ComfyUI references with Hanzo Studio
- Updated GitHub org URLs (Comfy-Org → hanzoui)
- Updated domains (comfy.org → hanzo.ai)
- Updated package names and npm scopes
- Updated LICENSE with Hanzo AI copyright header
2026-02-23 10:54:25 -08:00

684 lines
26 KiB
HTML

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>
Bandit Report
</title>
<style>
html * {
font-family: "Arial", sans-serif;
}
pre {
font-family: "Monaco", monospace;
}
.bordered-box {
border: 1px solid black;
padding-top:.5em;
padding-bottom:.5em;
padding-left:1em;
}
.metrics-box {
font-size: 1.1em;
line-height: 130%;
}
.metrics-title {
font-size: 1.5em;
font-weight: 500;
margin-bottom: .25em;
}
.issue-description {
font-size: 1.3em;
font-weight: 500;
}
.candidate-issues {
margin-left: 2em;
border-left: solid 1px; LightGray;
padding-left: 5%;
margin-top: .2em;
margin-bottom: .2em;
}
.issue-block {
border: 1px solid LightGray;
padding-left: .5em;
padding-top: .5em;
padding-bottom: .5em;
margin-bottom: .5em;
}
.issue-sev-high {
background-color: Pink;
}
.issue-sev-medium {
background-color: NavajoWhite;
}
.issue-sev-low {
background-color: LightCyan;
}
</style>
</head>
<body>
<div id="metrics">
<div class="metrics-box bordered-box">
<div class="metrics-title">
Metrics:<br>
</div>
Total lines of code: <span id="loc">10424</span><br>
Total lines skipped (#nosec): <span id="nosec">0</span>
</div>
</div>
<br>
<div id="results">
<div id="issue-0">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/__init__.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/__init__.py</a><br>
<b>Line number: </b>498<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
494 {&#x27;version&#x27;: config.version_code,
495 &#x27;name&#x27;: &#x27;Impact Pack&#x27;,
496 &#x27;nodes&#x27;: set(NODE_CLASS_MAPPINGS.keys()),
497 &#x27;description&#x27;: &#x27;This extension provides inpainting functionality based on the detector and detailer, along with convenient workflow features like wildcards and logics.&#x27;, })
498 except:
499 pass
</pre>
</div>
</div>
</div>
<div id="issue-1">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/disable.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/disable.py</a><br>
<b>Line number: </b>6<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
2 import sys
3 import time
4 import platform
5 import shutil
6 import subprocess
7
8 comfy_path = &#x27;../..&#x27;
9
</pre>
</div>
</div>
</div>
<div id="issue-2">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/disable.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/disable.py</a><br>
<b>Line number: </b>18<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
14 try:
15 retry_count -= 1
16
17 if platform.system() == &quot;Windows&quot;:
18 subprocess.check_call([&#x27;attrib&#x27;, &#x27;-R&#x27;, path + &#x27;\\*&#x27;, &#x27;/S&#x27;])
19
20 shutil.rmtree(path)
21
</pre>
</div>
</div>
</div>
<div id="issue-3">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/disable.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/disable.py</a><br>
<b>Line number: </b>18<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
14 try:
15 retry_count -= 1
16
17 if platform.system() == &quot;Windows&quot;:
18 subprocess.check_call([&#x27;attrib&#x27;, &#x27;-R&#x27;, path + &#x27;\\*&#x27;, &#x27;/S&#x27;])
19
20 shutil.rmtree(path)
21
</pre>
</div>
</div>
</div>
<div id="issue-4">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/install.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/install.py</a><br>
<b>Line number: </b>4<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1 import os
2 import shutil
3 import sys
4 import subprocess
5 import threading
6 import locale
7 import traceback
8 import re
</pre>
</div>
</div>
</div>
<div id="issue-5">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/install.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/install.py</a><br>
<b>Line number: </b>39<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
35
36
37 def process_wrap(cmd_str, cwd=None, handler=None):
38 print(f&quot;[Impact Pack] EXECUTE: {cmd_str} in &#x27;{cwd}&#x27;&quot;)
39 process = subprocess.Popen(cmd_str, cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1)
40
41 if handler is None:
42 handler = handle_stream
</pre>
</div>
</div>
</div>
<div id="issue-6">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/install.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/install.py</a><br>
<b>Line number: </b>65<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
61 global pip_list
62
63 if pip_list is None:
64 try:
65 result = subprocess.check_output([sys.executable, &#x27;-m&#x27;, &#x27;pip&#x27;, &#x27;list&#x27;], universal_newlines=True)
66 pip_list = set([line.split()[0].lower() for line in result.split(&#x27;\n&#x27;) if line.strip()])
67 except subprocess.CalledProcessError as e:
68 print(f&quot;[Hanzo Manager] Failed to retrieve the information of installed pip packages.&quot;)
</pre>
</div>
</div>
</div>
<div id="issue-7">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py</a><br>
<b>Line number: </b>2<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1 import sys
2 import subprocess
3
4
5 def ensure_onnx_package():
6 try:
7 import onnxruntime
8 except Exception:
</pre>
</div>
</div>
</div>
<div id="issue-8">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py</a><br>
<b>Line number: </b>10<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
6 try:
7 import onnxruntime
8 except Exception:
9 if &quot;python_embeded&quot; in sys.executable or &quot;python_embedded&quot; in sys.executable:
10 subprocess.check_call([sys.executable, &#x27;-s&#x27;, &#x27;-m&#x27;, &#x27;pip&#x27;, &#x27;install&#x27;, &#x27;onnxruntime&#x27;])
11 else:
12 subprocess.check_call([sys.executable, &#x27;-s&#x27;, &#x27;-m&#x27;, &#x27;pip&#x27;, &#x27;install&#x27;, &#x27;onnxruntime&#x27;])
</pre>
</div>
</div>
</div>
<div id="issue-9">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py</a><br>
<b>Line number: </b>12<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
8 except Exception:
9 if &quot;python_embeded&quot; in sys.executable or &quot;python_embedded&quot; in sys.executable:
10 subprocess.check_call([sys.executable, &#x27;-s&#x27;, &#x27;-m&#x27;, &#x27;pip&#x27;, &#x27;install&#x27;, &#x27;onnxruntime&#x27;])
11 else:
12 subprocess.check_call([sys.executable, &#x27;-s&#x27;, &#x27;-m&#x27;, &#x27;pip&#x27;, &#x27;install&#x27;, &#x27;onnxruntime&#x27;])
</pre>
</div>
</div>
</div>
<div id="issue-10">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/bridge_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/bridge_nodes.py</a><br>
<b>Line number: </b>164<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
160 super().__init__()
161 self.output_dir = folder_paths.get_temp_directory()
162 self.type = &quot;temp&quot;
163 self.prev_hash = None
164 self.prefix_append = &quot;_temp_&quot; + &#x27;&#x27;.join(random.choice(&quot;abcdefghijklmnopqrstupvxyz&quot;) for x in range(5))
165
166 @staticmethod
167 def load_image(pb_id):
</pre>
</div>
</div>
</div>
<div id="issue-11">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py</a><br>
<b>Line number: </b>383<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
379 and &#x27;value&#x27; in input_node[&#x27;inputs&#x27;] and &#x27;typ&#x27; in input_node[&#x27;inputs&#x27;]):
380 if &#x27;BOOLEAN&#x27; == input_node[&#x27;inputs&#x27;][&#x27;typ&#x27;]:
381 try:
382 onprompt_cond_branch_info[k] = input_node[&#x27;inputs&#x27;][&#x27;value&#x27;].lower() == &quot;true&quot;
383 except:
384 pass
385 else:
386 onprompt_cond_branch_info[k] = cond_input
387
</pre>
</div>
</div>
</div>
<div id="issue-12">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py</a><br>
<b>Line number: </b>464<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
460 new_seed = v[&#x27;inputs&#x27;][&#x27;seed_2nd&#x27;]-1
461 if new_seed &lt; 0:
462 new_seed = 1125899906842624
463 elif seed_2nd_mode == &#x27;randomize&#x27;:
464 new_seed = random.randint(0, 1125899906842624)
465
466 if new_seed is not None:
467 PromptServer.instance.send_sync(&quot;impact-node-feedback&quot;, {&quot;node_id&quot;: k, &quot;widget_name&quot;: &quot;seed_2nd&quot;, &quot;type&quot;: &quot;INT&quot;, &quot;value&quot;: new_seed})
</pre>
</div>
</div>
</div>
<div id="issue-13">
<div class="issue-block issue-sev-low">
<b>try_except_continue: </b> Try, Except, Continue detected.<br>
<b>Test ID:</b> B112<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py</a><br>
<b>Line number: </b>492<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b112_try_except_continue.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b112_try_except_continue.html</a><br>
<div class="code">
<pre>
488 continue
489 else:
490 print(f&quot;[Impact Pack] Only `ImpactInt`, `Seed (rgthree)` and `Primitive` Node are allowed as the seed for &#x27;{v[&#x27;class_type&#x27;]}&#x27;. It will be ignored. &quot;)
491 continue
492 except:
493 continue
494 else:
495 input_seed = int(inputs[&#x27;seed&#x27;])
496
</pre>
</div>
</div>
</div>
<div id="issue-14">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/sample_error_enhancer.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/sample_error_enhancer.py</a><br>
<b>Line number: </b>16<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
12 try:
13 if &#x27;mat1 and mat2 shapes cannot be multiplied&#x27; in e.args[0]:
14 if &#x27;torch.nn.functional.linear&#x27; in traceback.format_exc().strip().split(&#x27;\n&#x27;)[-3]:
15 is_model_mix_issue = True
16 except:
17 pass
18
19 if is_model_mix_issue:
20 raise RuntimeError(&quot;\n\n#### It seems that models and clips are mixed and interconnected between SDXL Base, SDXL Refiner, SD1.x, and SD2.x. Please verify. ####\n\n&quot;)
</pre>
</div>
</div>
</div>
<div id="issue-15">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/segs_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/segs_nodes.py</a><br>
<b>Line number: </b>1402<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
1398
1399 for pick in picks.split(&quot;,&quot;):
1400 try:
1401 pick_ids.add(int(pick)-1)
1402 except Exception:
1403 pass
1404
1405 new_segs = []
1406 for i in pick_ids:
</pre>
</div>
</div>
</div>
<div id="issue-16">
<div class="issue-block issue-sev-medium">
<b>yaml_load: </b> Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().<br>
<b>Test ID:</b> B506<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/20.html" target="_blank">CWE-20</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py</a><br>
<b>Line number: </b>62<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b506_yaml_load.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b506_yaml_load.html</a><br>
<div class="code">
<pre>
58 wildcard_dict[key] = lines
59 elif file.endswith(&#x27;.yaml&#x27;):
60 file_path = os.path.join(root, file)
61 with open(file_path, &#x27;r&#x27;) as f:
62 yaml_data = yaml.load(f, Loader=yaml.FullLoader)
63
64 for k, v in yaml_data.items():
65 read_wildcard(k, v)
</pre>
</div>
</div>
</div>
<div id="issue-17">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py</a><br>
<b>Line number: </b>443<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
439 if i &lt; len(matches):
440 if matches[i] == &#x27;[SEP]&#x27;:
441 result_list.append(None)
442 elif matches[i] == &#x27;[SEP:R]&#x27;:
443 result_list.append(random.randint(0, 1125899906842624))
444 else:
445 try:
446 seed = int(matches[i][5:-1])
</pre>
</div>
</div>
</div>
<div id="issue-18">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py</a><br>
<b>Line number: </b>6<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
2 import sys
3 import time
4 import platform
5 import shutil
6 import subprocess
7
8 comfy_path = &#x27;../..&#x27;
9
</pre>
</div>
</div>
</div>
<div id="issue-19">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py</a><br>
<b>Line number: </b>18<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
14 try:
15 retry_count -= 1
16
17 if platform.system() == &quot;Windows&quot;:
18 subprocess.check_call([&#x27;attrib&#x27;, &#x27;-R&#x27;, path + &#x27;\\*&#x27;, &#x27;/S&#x27;])
19
20 shutil.rmtree(path)
21
</pre>
</div>
</div>
</div>
<div id="issue-20">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py</a><br>
<b>Line number: </b>18<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
14 try:
15 retry_count -= 1
16
17 if platform.system() == &quot;Windows&quot;:
18 subprocess.check_call([&#x27;attrib&#x27;, &#x27;-R&#x27;, path + &#x27;\\*&#x27;, &#x27;/S&#x27;])
19
20 shutil.rmtree(path)
21
</pre>
</div>
</div>
</div>
</div>
</body>
</html>