mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
- Updated copyright to Hanzo AI, Inc. - Replaced ComfyUI references with Hanzo Studio - Updated GitHub org URLs (Comfy-Org → hanzoui) - Updated domains (comfy.org → hanzo.ai) - Updated package names and npm scopes - Updated LICENSE with Hanzo AI copyright header
684 lines
26 KiB
HTML
684 lines
26 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">10424</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/__init__.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/__init__.py</a><br>
|
|
<b>Line number: </b>498<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
494 {'version': config.version_code,
|
|
495 'name': 'Impact Pack',
|
|
496 'nodes': set(NODE_CLASS_MAPPINGS.keys()),
|
|
497 'description': 'This extension provides inpainting functionality based on the detector and detailer, along with convenient workflow features like wildcards and logics.', })
|
|
498 except:
|
|
499 pass
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/disable.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/disable.py</a><br>
|
|
<b>Line number: </b>6<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
2 import sys
|
|
3 import time
|
|
4 import platform
|
|
5 import shutil
|
|
6 import subprocess
|
|
7
|
|
8 comfy_path = '../..'
|
|
9
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/disable.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/disable.py</a><br>
|
|
<b>Line number: </b>18<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
14 try:
|
|
15 retry_count -= 1
|
|
16
|
|
17 if platform.system() == "Windows":
|
|
18 subprocess.check_call(['attrib', '-R', path + '\\*', '/S'])
|
|
19
|
|
20 shutil.rmtree(path)
|
|
21
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/disable.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/disable.py</a><br>
|
|
<b>Line number: </b>18<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
14 try:
|
|
15 retry_count -= 1
|
|
16
|
|
17 if platform.system() == "Windows":
|
|
18 subprocess.check_call(['attrib', '-R', path + '\\*', '/S'])
|
|
19
|
|
20 shutil.rmtree(path)
|
|
21
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/install.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/install.py</a><br>
|
|
<b>Line number: </b>4<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import os
|
|
2 import shutil
|
|
3 import sys
|
|
4 import subprocess
|
|
5 import threading
|
|
6 import locale
|
|
7 import traceback
|
|
8 import re
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/install.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/install.py</a><br>
|
|
<b>Line number: </b>39<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
35
|
|
36
|
|
37 def process_wrap(cmd_str, cwd=None, handler=None):
|
|
38 print(f"[Impact Pack] EXECUTE: {cmd_str} in '{cwd}'")
|
|
39 process = subprocess.Popen(cmd_str, cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1)
|
|
40
|
|
41 if handler is None:
|
|
42 handler = handle_stream
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/install.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/install.py</a><br>
|
|
<b>Line number: </b>65<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
61 global pip_list
|
|
62
|
|
63 if pip_list is None:
|
|
64 try:
|
|
65 result = subprocess.check_output([sys.executable, '-m', 'pip', 'list'], universal_newlines=True)
|
|
66 pip_list = set([line.split()[0].lower() for line in result.split('\n') if line.strip()])
|
|
67 except subprocess.CalledProcessError as e:
|
|
68 print(f"[Hanzo Manager] Failed to retrieve the information of installed pip packages.")
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py</a><br>
|
|
<b>Line number: </b>2<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import sys
|
|
2 import subprocess
|
|
3
|
|
4
|
|
5 def ensure_onnx_package():
|
|
6 try:
|
|
7 import onnxruntime
|
|
8 except Exception:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py</a><br>
|
|
<b>Line number: </b>10<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
6 try:
|
|
7 import onnxruntime
|
|
8 except Exception:
|
|
9 if "python_embeded" in sys.executable or "python_embedded" in sys.executable:
|
|
10 subprocess.check_call([sys.executable, '-s', '-m', 'pip', 'install', 'onnxruntime'])
|
|
11 else:
|
|
12 subprocess.check_call([sys.executable, '-s', '-m', 'pip', 'install', 'onnxruntime'])
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/additional_dependencies.py</a><br>
|
|
<b>Line number: </b>12<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
8 except Exception:
|
|
9 if "python_embeded" in sys.executable or "python_embedded" in sys.executable:
|
|
10 subprocess.check_call([sys.executable, '-s', '-m', 'pip', 'install', 'onnxruntime'])
|
|
11 else:
|
|
12 subprocess.check_call([sys.executable, '-s', '-m', 'pip', 'install', 'onnxruntime'])
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-10">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/bridge_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/bridge_nodes.py</a><br>
|
|
<b>Line number: </b>164<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
160 super().__init__()
|
|
161 self.output_dir = folder_paths.get_temp_directory()
|
|
162 self.type = "temp"
|
|
163 self.prev_hash = None
|
|
164 self.prefix_append = "_temp_" + ''.join(random.choice("abcdefghijklmnopqrstupvxyz") for x in range(5))
|
|
165
|
|
166 @staticmethod
|
|
167 def load_image(pb_id):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-11">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py</a><br>
|
|
<b>Line number: </b>383<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
379 and 'value' in input_node['inputs'] and 'typ' in input_node['inputs']):
|
|
380 if 'BOOLEAN' == input_node['inputs']['typ']:
|
|
381 try:
|
|
382 onprompt_cond_branch_info[k] = input_node['inputs']['value'].lower() == "true"
|
|
383 except:
|
|
384 pass
|
|
385 else:
|
|
386 onprompt_cond_branch_info[k] = cond_input
|
|
387
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-12">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py</a><br>
|
|
<b>Line number: </b>464<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
460 new_seed = v['inputs']['seed_2nd']-1
|
|
461 if new_seed < 0:
|
|
462 new_seed = 1125899906842624
|
|
463 elif seed_2nd_mode == 'randomize':
|
|
464 new_seed = random.randint(0, 1125899906842624)
|
|
465
|
|
466 if new_seed is not None:
|
|
467 PromptServer.instance.send_sync("impact-node-feedback", {"node_id": k, "widget_name": "seed_2nd", "type": "INT", "value": new_seed})
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-13">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_continue: </b> Try, Except, Continue detected.<br>
|
|
<b>Test ID:</b> B112<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/impact_server.py</a><br>
|
|
<b>Line number: </b>492<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b112_try_except_continue.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b112_try_except_continue.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
488 continue
|
|
489 else:
|
|
490 print(f"[Impact Pack] Only `ImpactInt`, `Seed (rgthree)` and `Primitive` Node are allowed as the seed for '{v['class_type']}'. It will be ignored. ")
|
|
491 continue
|
|
492 except:
|
|
493 continue
|
|
494 else:
|
|
495 input_seed = int(inputs['seed'])
|
|
496
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-14">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/sample_error_enhancer.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/sample_error_enhancer.py</a><br>
|
|
<b>Line number: </b>16<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
12 try:
|
|
13 if 'mat1 and mat2 shapes cannot be multiplied' in e.args[0]:
|
|
14 if 'torch.nn.functional.linear' in traceback.format_exc().strip().split('\n')[-3]:
|
|
15 is_model_mix_issue = True
|
|
16 except:
|
|
17 pass
|
|
18
|
|
19 if is_model_mix_issue:
|
|
20 raise RuntimeError("\n\n#### It seems that models and clips are mixed and interconnected between SDXL Base, SDXL Refiner, SD1.x, and SD2.x. Please verify. ####\n\n")
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-15">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/segs_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/segs_nodes.py</a><br>
|
|
<b>Line number: </b>1402<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1398
|
|
1399 for pick in picks.split(","):
|
|
1400 try:
|
|
1401 pick_ids.add(int(pick)-1)
|
|
1402 except Exception:
|
|
1403 pass
|
|
1404
|
|
1405 new_segs = []
|
|
1406 for i in pick_ids:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-16">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>yaml_load: </b> Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().<br>
|
|
<b>Test ID:</b> B506<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/20.html" target="_blank">CWE-20</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py</a><br>
|
|
<b>Line number: </b>62<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b506_yaml_load.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b506_yaml_load.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
58 wildcard_dict[key] = lines
|
|
59 elif file.endswith('.yaml'):
|
|
60 file_path = os.path.join(root, file)
|
|
61 with open(file_path, 'r') as f:
|
|
62 yaml_data = yaml.load(f, Loader=yaml.FullLoader)
|
|
63
|
|
64 for k, v in yaml_data.items():
|
|
65 read_wildcard(k, v)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-17">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/modules/impact/wildcards.py</a><br>
|
|
<b>Line number: </b>443<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
439 if i < len(matches):
|
|
440 if matches[i] == '[SEP]':
|
|
441 result_list.append(None)
|
|
442 elif matches[i] == '[SEP:R]':
|
|
443 result_list.append(random.randint(0, 1125899906842624))
|
|
444 else:
|
|
445 try:
|
|
446 seed = int(matches[i][5:-1])
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-18">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py</a><br>
|
|
<b>Line number: </b>6<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
2 import sys
|
|
3 import time
|
|
4 import platform
|
|
5 import shutil
|
|
6 import subprocess
|
|
7
|
|
8 comfy_path = '../..'
|
|
9
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-19">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py</a><br>
|
|
<b>Line number: </b>18<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
14 try:
|
|
15 retry_count -= 1
|
|
16
|
|
17 if platform.system() == "Windows":
|
|
18 subprocess.check_call(['attrib', '-R', path + '\\*', '/S'])
|
|
19
|
|
20 shutil.rmtree(path)
|
|
21
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-20">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py" target="_blank">/custom_nodes/Hanzo Studio-Impact-Pack/uninstall.py</a><br>
|
|
<b>Line number: </b>18<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
14 try:
|
|
15 retry_count -= 1
|
|
16
|
|
17 if platform.system() == "Windows":
|
|
18 subprocess.check_call(['attrib', '-R', path + '\\*', '/S'])
|
|
19
|
|
20 shutil.rmtree(path)
|
|
21
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|