hanzoui/custom-nodes-security-scan
1
0
Fork 0
mirror of https://github.com/hanzoui/custom-nodes-security-scan.git synced 2026-10-30 20:56:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
custom-nodes-security-scan/docs/ComfyUI-KJNodes-bandit.html
T
zeekay 6bdea42e64 rebrand: Hanzo AI Inc — full rebrand from ComfyUI/Comfy-Org 
- Updated copyright to Hanzo AI, Inc.
- Replaced ComfyUI references with Hanzo Studio
- Updated GitHub org URLs (Comfy-Org → hanzoui)
- Updated domains (comfy.org → hanzo.ai)
- Updated package names and npm scopes
- Updated LICENSE with Hanzo AI copyright header
2026-02-23 10:54:25 -08:00

299 lines
10 KiB
HTML
Raw Permalink Blame History

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>
Bandit Report
</title>
<style>
html * {
font-family: "Arial", sans-serif;
}
pre {
font-family: "Monaco", monospace;
}
.bordered-box {
border: 1px solid black;
padding-top:.5em;
padding-bottom:.5em;
padding-left:1em;
}
.metrics-box {
font-size: 1.1em;
line-height: 130%;
}
.metrics-title {
font-size: 1.5em;
font-weight: 500;
margin-bottom: .25em;
}
.issue-description {
font-size: 1.3em;
font-weight: 500;
}
.candidate-issues {
margin-left: 2em;
border-left: solid 1px; LightGray;
padding-left: 5%;
margin-top: .2em;
margin-bottom: .2em;
}
.issue-block {
border: 1px solid LightGray;
padding-left: .5em;
padding-top: .5em;
padding-bottom: .5em;
margin-bottom: .5em;
}
.issue-sev-high {
background-color: Pink;
}
.issue-sev-medium {
background-color: NavajoWhite;
}
.issue-sev-low {
background-color: LightCyan;
}
</style>
</head>
<body>
<div id="metrics">
<div class="metrics-box bordered-box">
<div class="metrics-title">
Metrics:<br>
</div>
Total lines of code: <span id="loc">5755</span><br>
Total lines skipped (#nosec): <span id="nosec">0</span>
</div>
</div>
<br>
<div id="results">
<div id="issue-0">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py</a><br>
<b>Line number: </b>308<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
304 image = Image.new(&quot;RGB&quot;, (width, height), color=&#x27;black&#x27;)
305 draw = ImageDraw.Draw(image)
306
307 # Generate a random color for the text
308 font_color = (random.randint(0, 255), random.randint(0, 255), random.randint(0, 255))
309
310 font = ImageFont.truetype(font_path, font_size)
311
</pre>
</div>
</div>
</div>
<div id="issue-1">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py</a><br>
<b>Line number: </b>308<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
304 image = Image.new(&quot;RGB&quot;, (width, height), color=&#x27;black&#x27;)
305 draw = ImageDraw.Draw(image)
306
307 # Generate a random color for the text
308 font_color = (random.randint(0, 255), random.randint(0, 255), random.randint(0, 255))
309
310 font = ImageFont.truetype(font_path, font_size)
311
</pre>
</div>
</div>
</div>
<div id="issue-2">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py</a><br>
<b>Line number: </b>308<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
304 image = Image.new(&quot;RGB&quot;, (width, height), color=&#x27;black&#x27;)
305 draw = ImageDraw.Draw(image)
306
307 # Generate a random color for the text
308 font_color = (random.randint(0, 255), random.randint(0, 255), random.randint(0, 255))
309
310 font = ImageFont.truetype(font_path, font_size)
311
</pre>
</div>
</div>
</div>
<div id="issue-3">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py</a><br>
<b>Line number: </b>462<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
458
459 if caption == &quot;&quot;:
460 processed_images = [process_image(img, text) for img in image]
461 else:
462 assert len(caption) == batch_size, &quot;Number of captions does not match number of images&quot;
463 processed_images = [process_image(img, cap) for img, cap in zip(image, caption)]
464 processed_batch = torch.cat(processed_images, dim=0)
465
</pre>
</div>
</div>
</div>
<div id="issue-4">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py</a><br>
<b>Line number: </b>820<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
816 class ImageAndMaskPreview(SaveImage):
817 def __init__(self):
818 self.output_dir = folder_paths.get_temp_directory()
819 self.type = &quot;temp&quot;
820 self.prefix_append = &quot;_temp_&quot; + &#x27;&#x27;.join(random.choice(&quot;abcdefghijklmnopqrstupvxyz&quot;) for x in range(5))
821 self.compress_level = 4
822
823 @classmethod
</pre>
</div>
</div>
</div>
<div id="issue-5">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py" target="_blank">/custom_nodes/Hanzo Studio-KJNodes/nodes/image_nodes.py</a><br>
<b>Line number: </b>1189<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
1185 class PreviewAnimation:
1186 def __init__(self):
1187 self.output_dir = folder_paths.get_temp_directory()
1188 self.type = &quot;temp&quot;
1189 self.prefix_append = &quot;_temp_&quot; + &#x27;&#x27;.join(random.choice(&quot;abcdefghijklmnopqrstupvxyz&quot;) for x in range(5))
1190 self.compress_level = 1
1191
1192 methods = {&quot;default&quot;: 4, &quot;fastest&quot;: 0, &quot;slowest&quot;: 6}
</pre>
</div>
</div>
</div>
<div id="issue-6">
<div class="issue-block issue-sev-medium">
<b>request_without_timeout: </b> Requests call without timeout<br>
<b>Test ID:</b> B113<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>LOW<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-KJNodes/nodes/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-KJNodes/nodes/nodes.py</a><br>
<b>Line number: </b>1630<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
<div class="code">
<pre>
1626 config = json.load(file)
1627 api_key_from_config = config.get(&quot;sai_api_key&quot;)
1628 headers[&quot;authorization&quot;] = api_key_from_config
1629
1630 response = requests.post(
1631 f&quot;https://api.stability.ai/v2beta/stable-image/generate/sd3&quot;,
1632 headers=headers,
1633 files = files,
1634 data = data,
1635 )
1636
1637 if response.status_code == 200:
1638 # Convert the response content to a PIL Image
</pre>
</div>
</div>
</div>
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink