mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
zeekay
6bdea42e64
- Updated copyright to Hanzo AI, Inc. - Replaced ComfyUI references with Hanzo Studio - Updated GitHub org URLs (Comfy-Org → hanzoui) - Updated domains (comfy.org → hanzo.ai) - Updated package names and npm scopes - Updated LICENSE with Hanzo AI copyright header
236 lines
6.7 KiB
HTML
236 lines
6.7 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">2452</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with pickle module.<br>
|
|
<b>Test ID:</b> B403<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/502.html" target="_blank">CWE-502</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/template_maker.py" target="_blank">/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/template_maker.py</a><br>
|
|
<b>Line number: </b>10<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b403-import-pickle" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b403-import-pickle</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
6
|
|
7 import os
|
|
8 import cv2
|
|
9 import numpy as np
|
|
10 import pickle
|
|
11 from tqdm import tqdm
|
|
12 from .utils.cropper import Cropper
|
|
13
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/helper.py" target="_blank">/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/helper.py</a><br>
|
|
<b>Line number: </b>73<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
69 Return: (bs, 2k*3)
|
|
70 """
|
|
71 bs_src = kp_source.shape[0]
|
|
72 bs_dri = kp_driving.shape[0]
|
|
73 assert bs_src == bs_dri, 'batch size must be equal'
|
|
74
|
|
75 feat = torch.cat([kp_source.view(bs_src, -1), kp_driving.view(bs_dri, -1)], dim=1)
|
|
76 return feat
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/video.py" target="_blank">/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/video.py</a><br>
|
|
<b>Line number: </b>9<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
5 """
|
|
6
|
|
7 import os.path as osp
|
|
8 import numpy as np
|
|
9 import subprocess
|
|
10 import imageio
|
|
11 import cv2
|
|
12
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-high">
|
|
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True identified, security issue.<br>
|
|
<b>Test ID:</b> B602<br>
|
|
<b>Severity: </b>HIGH<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/video.py" target="_blank">/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/video.py</a><br>
|
|
<b>Line number: </b>19<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
15 from .rprint import rprint as print
|
|
16
|
|
17
|
|
18 def exec_cmd(cmd):
|
|
19 subprocess.run(cmd, shell=True, check=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
|
|
20
|
|
21
|
|
22 def images2video(images, wfp, **kwargs):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
|
|
<b>Test ID:</b> B307<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/video.py" target="_blank">/custom_nodes/Hanzo Studio-LivePortraitKJ/liveportrait/utils/video.py</a><br>
|
|
<b>Line number: </b>138<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
134 def get_fps(filepath):
|
|
135 import ffmpeg
|
|
136 probe = ffmpeg.probe(filepath)
|
|
137 video_stream = next((stream for stream in probe['streams'] if stream['codec_type'] == 'video'), None)
|
|
138 fps = eval(video_stream['avg_frame_rate'])
|
|
139 return fps
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|