mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
zeekay
6bdea42e64
- Updated copyright to Hanzo AI, Inc. - Replaced ComfyUI references with Hanzo Studio - Updated GitHub org URLs (Comfy-Org → hanzoui) - Updated domains (comfy.org → hanzo.ai) - Updated package names and npm scopes - Updated LICENSE with Hanzo AI copyright header
298 lines
10 KiB
HTML
298 lines
10 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">6389</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/jake_upgrade.py" target="_blank">/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/jake_upgrade.py</a><br>
|
|
<b>Line number: </b>1026<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1022 image_name = project_name + "_" + image_name
|
|
1023 path_name = project_name + "/" + path_name
|
|
1024
|
|
1025 random.seed(seed)
|
|
1026 number = random.randint (0, 18446744073709551615)
|
|
1027
|
|
1028 return (image_name, path_name, seed)
|
|
1029
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/format/a1111.py" target="_blank">/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/format/a1111.py</a><br>
|
|
<b>Line number: </b>100<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
96 single_line_prompt += " --seed_resize_from_w " + seed_resize_from_w
|
|
97 single_line_prompt += " --seed_resize_from_h " + seed_resize_from_h
|
|
98 try:
|
|
99 (tag, is_str) = A1111.PROMPT_MAPPING.get(key)
|
|
100 except:
|
|
101 pass
|
|
102 else:
|
|
103 if is_str:
|
|
104 single_line_prompt += " --" + tag + " " + add_quotes(str(value))
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Using minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.<br>
|
|
<b>Test ID:</b> B408<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/20.html" target="_blank">CWE-20</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/image_data_reader.py" target="_blank">/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/image_data_reader.py</a><br>
|
|
<b>Line number: </b>7<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b408-import-xml-minidom" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b408-import-xml-minidom</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
3 __copyright__ = "Copyright 2023"
|
|
4 __email__ = "[email protected]"
|
|
5
|
|
6 import json
|
|
7 from xml.dom import minidom
|
|
8
|
|
9 import piexif
|
|
10 import piexif.helper
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Using xml.dom.minidom.parseString to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parseString with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called<br>
|
|
<b>Test ID:</b> B318<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/20.html" target="_blank">CWE-20</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/image_data_reader.py" target="_blank">/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/image_data_reader.py</a><br>
|
|
<b>Line number: </b>119<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b313-b320-xml-bad-minidom" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b313-b320-xml-bad-minidom</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
115 print("Fooocus format error")
|
|
116 # drawthings format
|
|
117 elif "XML:com.adobe.xmp" in self._info:
|
|
118 try:
|
|
119 data = minidom.parseString(
|
|
120 self._info.get("XML:com.adobe.xmp")
|
|
121 )
|
|
122 data_json = json.loads(
|
|
123 data.getElementsByTagName("exif:UserComment")[0]
|
|
124 .childNodes[1]
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/image_data_reader.py" target="_blank">/custom_nodes/Hanzo Studio-JakeUpgrade/nodes/sd_prompt_reader/image_data_reader.py</a><br>
|
|
<b>Line number: </b>152<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
148 piexif.ExifIFD.UserComment
|
|
149 )
|
|
150 except TypeError:
|
|
151 print("empty jpeg")
|
|
152 except Exception:
|
|
153 pass
|
|
154 else:
|
|
155 # swarm format
|
|
156 if "sui_image_params" in user_comment[8:].decode("utf-16"):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-JakeUpgrade/replacement/ComfyUi_PromptStylers/sdxl_prompt_styler.py" target="_blank">/custom_nodes/Hanzo Studio-JakeUpgrade/replacement/ComfyUi_PromptStylers/sdxl_prompt_styler.py</a><br>
|
|
<b>Line number: </b>151<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
147 CATEGORY = 'Style Prompts'
|
|
148
|
|
149 def prompt_styler(self, text_positive, text_negative, style, log_prompt, auto_select_style=False, auto_refresh=False):
|
|
150 if auto_select_style or auto_refresh:
|
|
151 style = random.choice([template['name'] for template in self.json_data])
|
|
152
|
|
153 positive_prompt, negative_prompt = read_sdxl_templates_replace_and_combine(self.json_data, style, text_positive, text_negative)
|
|
154
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-JakeUpgrade/replacement/ComfyUi_PromptStylers/sdxl_prompt_styler.py" target="_blank">/custom_nodes/Hanzo Studio-JakeUpgrade/replacement/ComfyUi_PromptStylers/sdxl_prompt_styler.py</a><br>
|
|
<b>Line number: </b>1835<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1831 CATEGORY = 'Style Prompts'
|
|
1832
|
|
1833 def prompt_styler(self, text_positive, text_negative, style, log_prompt, random_style=False):
|
|
1834 if random_style:
|
|
1835 style = random.choice([template['name'] for template in self.json_data])
|
|
1836 else:
|
|
1837 style = text_positive # You can change this to the appropriate parameter
|
|
1838
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|