mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
- Updated copyright to Hanzo AI, Inc. - Replaced ComfyUI references with Hanzo Studio - Updated GitHub org URLs (Comfy-Org → hanzoui) - Updated domains (comfy.org → hanzo.ai) - Updated package names and npm scopes - Updated LICENSE with Hanzo AI copyright header
1709 lines
68 KiB
HTML
1709 lines
68 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">3968</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/cm-cli.py" target="_blank">/custom_nodes/Hanzo Manager/cm-cli.py</a><br>
|
|
<b>Line number: </b>7<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
3 import sys
|
|
4 import traceback
|
|
5 import json
|
|
6 import asyncio
|
|
7 import subprocess
|
|
8 import shutil
|
|
9 import concurrent
|
|
10 import threading
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/cm-cli.py" target="_blank">/custom_nodes/Hanzo Manager/cm-cli.py</a><br>
|
|
<b>Line number: </b>78<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
74 for line in file:
|
|
75 package_name = core.remap_pip_package(line.strip())
|
|
76 if package_name and not core.is_installed(package_name):
|
|
77 install_cmd = [sys.executable, "-m", "pip", "install", package_name]
|
|
78 output = subprocess.check_output(install_cmd, cwd=repo_path, text=True)
|
|
79 for msg_line in output.split('\n'):
|
|
80 if 'Requirement already satisfied:' in msg_line:
|
|
81 print('.', end='')
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/cm-cli.py" target="_blank">/custom_nodes/Hanzo Manager/cm-cli.py</a><br>
|
|
<b>Line number: </b>88<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
84
|
|
85 if os.path.exists(install_script_path) and f'{repo_path}/install.py' not in processed_install:
|
|
86 processed_install.add(f'{repo_path}/install.py')
|
|
87 install_cmd = [sys.executable, install_script_path]
|
|
88 output = subprocess.check_output(install_cmd, cwd=repo_path, text=True)
|
|
89 for msg_line in output.split('\n'):
|
|
90 if 'Requirement already satisfied:' in msg_line:
|
|
91 print('.', end='')
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/cm-cli.py" target="_blank">/custom_nodes/Hanzo Manager/cm-cli.py</a><br>
|
|
<b>Line number: </b>174<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
170 is_failed = True
|
|
171
|
|
172 print(f"Restore snapshot.")
|
|
173 cmd_str = [sys.executable, git_script_path, '--apply-snapshot', snapshot_path] + extras
|
|
174 output = subprocess.check_output(cmd_str, cwd=custom_nodes_path, text=True)
|
|
175 msg_lines = output.split('\n')
|
|
176 extract_infos(msg_lines)
|
|
177
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/cm-cli.py" target="_blank">/custom_nodes/Hanzo Manager/cm-cli.py</a><br>
|
|
<b>Line number: </b>226<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
222 items = default_conf['downgrade_blacklist'].split(',')
|
|
223 items = [x.strip() for x in items if x != '']
|
|
224 cm_global.pip_downgrade_blacklist += items
|
|
225 cm_global.pip_downgrade_blacklist = list(set(cm_global.pip_downgrade_blacklist))
|
|
226 except:
|
|
227 pass
|
|
228
|
|
229
|
|
230 read_downgrade_blacklist()
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>1<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import subprocess
|
|
2 import sys
|
|
3 import os
|
|
4 import traceback
|
|
5
|
|
6 import git
|
|
7 import configparser
|
|
8 import re
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>351<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
347 if '--pip-non-url' in options:
|
|
348 # try all at once
|
|
349 res = 1
|
|
350 try:
|
|
351 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install'] + non_url)
|
|
352 except:
|
|
353 pass
|
|
354
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>352<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
348 # try all at once
|
|
349 res = 1
|
|
350 try:
|
|
351 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install'] + non_url)
|
|
352 except:
|
|
353 pass
|
|
354
|
|
355 # fallback
|
|
356 if res != 0:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>360<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
356 if res != 0:
|
|
357 for x in non_url:
|
|
358 res = 1
|
|
359 try:
|
|
360 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
|
|
361 except:
|
|
362 pass
|
|
363
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>361<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
357 for x in non_url:
|
|
358 res = 1
|
|
359 try:
|
|
360 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
|
|
361 except:
|
|
362 pass
|
|
363
|
|
364 if res != 0:
|
|
365 failed.append(x)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-10">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>371<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
367 if '--pip-non-local-url' in options:
|
|
368 for x in non_local_url:
|
|
369 res = 1
|
|
370 try:
|
|
371 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
|
|
372 except:
|
|
373 pass
|
|
374
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-11">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>372<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
368 for x in non_local_url:
|
|
369 res = 1
|
|
370 try:
|
|
371 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
|
|
372 except:
|
|
373 pass
|
|
374
|
|
375 if res != 0:
|
|
376 failed.append(x)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-12">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>382<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
378 if '--pip-local-url' in options:
|
|
379 for x in local_url:
|
|
380 res = 1
|
|
381 try:
|
|
382 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
|
|
383 except:
|
|
384 pass
|
|
385
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-13">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/git_helper.py" target="_blank">/custom_nodes/Hanzo Manager/git_helper.py</a><br>
|
|
<b>Line number: </b>383<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
379 for x in local_url:
|
|
380 res = 1
|
|
381 try:
|
|
382 res = subprocess.check_call([sys.executable, '-m', 'pip', 'install', x])
|
|
383 except:
|
|
384 pass
|
|
385
|
|
386 if res != 0:
|
|
387 failed.append(x)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-14">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>3<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import os
|
|
2 import sys
|
|
3 import subprocess
|
|
4 import re
|
|
5 import shutil
|
|
6 import configparser
|
|
7 import platform
|
|
8 from datetime import datetime
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-15">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>69<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
65 global pip_map
|
|
66
|
|
67 if pip_map is None:
|
|
68 try:
|
|
69 result = subprocess.check_output([sys.executable, '-m', 'pip', 'list'], universal_newlines=True)
|
|
70
|
|
71 pip_map = {}
|
|
72 for line in result.split('\n'):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-16">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>184<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
180 if len(cmd) > 0 and cmd[0].startswith("#"):
|
|
181 print(f"[Hanzo Manager] Unexpected behavior: `{cmd}`")
|
|
182 return 0
|
|
183
|
|
184 subprocess.check_call(cmd, cwd=cwd)
|
|
185
|
|
186 return 0
|
|
187
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-17">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>309<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
305 print("\n\n###################################################################")
|
|
306 print(f"[WARN] Hanzo Manager: Your Hanzo Studio version ({comfy_ui_revision})[{comfy_ui_commit_datetime.date()}] is too old. Please update to the latest version.")
|
|
307 print(f"[WARN] The extension installation feature may not work properly in the current installed Hanzo Studio version on Windows environment.")
|
|
308 print("###################################################################\n\n")
|
|
309 except:
|
|
310 pass
|
|
311
|
|
312 if code != 0:
|
|
313 if url is None:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-18">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>328<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
324 command = [sys.executable, git_script_path, "--pull", path]
|
|
325 else:
|
|
326 command = [sys.executable, git_script_path, "--check", path]
|
|
327
|
|
328 process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, cwd=custom_nodes_path)
|
|
329 output, _ = process.communicate()
|
|
330 output = output.decode('utf-8').strip()
|
|
331
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-19">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>337<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
333 # fix and try again
|
|
334 safedir_path = path.replace('\\', '/')
|
|
335 try:
|
|
336 print(f"[Hanzo Manager] Try fixing 'dubious repository' error on '{safedir_path}' repo")
|
|
337 process = subprocess.Popen(['git', 'config', '--global', '--add', 'safe.directory', safedir_path], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
338 output, _ = process.communicate()
|
|
339
|
|
340 process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-20">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>337<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
333 # fix and try again
|
|
334 safedir_path = path.replace('\\', '/')
|
|
335 try:
|
|
336 print(f"[Hanzo Manager] Try fixing 'dubious repository' error on '{safedir_path}' repo")
|
|
337 process = subprocess.Popen(['git', 'config', '--global', '--add', 'safe.directory', safedir_path], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
338 output, _ = process.communicate()
|
|
339
|
|
340 process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-21">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>340<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
336 print(f"[Hanzo Manager] Try fixing 'dubious repository' error on '{safedir_path}' repo")
|
|
337 process = subprocess.Popen(['git', 'config', '--global', '--add', 'safe.directory', safedir_path], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
338 output, _ = process.communicate()
|
|
339
|
|
340 process = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
341 output, _ = process.communicate()
|
|
342 output = output.decode('utf-8').strip()
|
|
343 except Exception:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-22">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>380<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
376
|
|
377
|
|
378 def __win_check_git_pull(path):
|
|
379 command = [sys.executable, git_script_path, "--pull", path]
|
|
380 process = subprocess.Popen(command, cwd=custom_nodes_path)
|
|
381 process.wait()
|
|
382
|
|
383
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-23">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>856<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
852 except Exception as e:
|
|
853 if 'detected dubious' in str(e):
|
|
854 print(f"[Hanzo Manager] Try fixing 'dubious repository' error on 'Hanzo Studio' repository")
|
|
855 safedir_path = comfy_path.replace('\\', '/')
|
|
856 subprocess.run(['git', 'config', '--global', '--add', 'safe.directory', safedir_path])
|
|
857 try:
|
|
858 remote.fetch()
|
|
859 except Exception:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-24">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>856<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
852 except Exception as e:
|
|
853 if 'detected dubious' in str(e):
|
|
854 print(f"[Hanzo Manager] Try fixing 'dubious repository' error on 'Hanzo Studio' repository")
|
|
855 safedir_path = comfy_path.replace('\\', '/')
|
|
856 subprocess.run(['git', 'config', '--global', '--add', 'safe.directory', safedir_path])
|
|
857 try:
|
|
858 remote.fetch()
|
|
859 except Exception:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-25">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_core.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_core.py</a><br>
|
|
<b>Line number: </b>961<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
957
|
|
958
|
|
959 def get_installed_pip_packages():
|
|
960 # extract pip package infos
|
|
961 pips = subprocess.check_output([sys.executable, '-m', 'pip', 'freeze'], text=True).split('\n')
|
|
962
|
|
963 res = {}
|
|
964 for x in pips:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-26">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>6<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
2 import traceback
|
|
3
|
|
4 import folder_paths
|
|
5 import locale
|
|
6 import subprocess # don't remove this
|
|
7 import concurrent
|
|
8 import nodes
|
|
9 import hashlib
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-27">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>91<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
87 if len(cmd) > 0 and cmd[0].startswith("#"):
|
|
88 print(f"[Hanzo Manager] Unexpected behavior: `{cmd}`")
|
|
89 return 0
|
|
90
|
|
91 process = subprocess.Popen(cmd, cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1)
|
|
92
|
|
93 stdout_thread = threading.Thread(target=handle_stream, args=(process.stdout, ""))
|
|
94 stderr_thread = threading.Thread(target=handle_stream, args=(process.stderr, "[!]"))
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-28">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>173<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
169
|
|
170 try:
|
|
171 if core.comfy_ui_commit_datetime.date() < core.comfy_ui_required_commit_datetime.date():
|
|
172 print(f"\n\n## [WARN] Hanzo Manager: Your Hanzo Studio version ({core.comfy_ui_revision})[{core.comfy_ui_commit_datetime.date()}] is too old. Please update to the latest version. ##\n\n")
|
|
173 except:
|
|
174 pass
|
|
175
|
|
176 # process on_revision_detected -->
|
|
177 if 'cm.on_revision_detected_handler' in cm_global.variables:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-29">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
|
|
<b>Test ID:</b> B310<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>657<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
653 headers = {
|
|
654 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'}
|
|
655
|
|
656 req = urllib.request.Request(url, headers=headers)
|
|
657 response = urllib.request.urlopen(req)
|
|
658 data = response.read()
|
|
659
|
|
660 with open(temp_filename, 'wb') as f:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-30">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
|
|
<b>Test ID:</b> B310<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>681<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
677 headers = {
|
|
678 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'}
|
|
679
|
|
680 req = urllib.request.Request(url, headers=headers)
|
|
681 response = urllib.request.urlopen(req)
|
|
682 data = response.read()
|
|
683
|
|
684 if not os.path.exists(os.path.dirname(save_path)):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-31">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1144<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1140
|
|
1141 try:
|
|
1142 if core.comfy_ui_required_commit_datetime.date() > core.comfy_ui_commit_datetime.date():
|
|
1143 markdown_content = f'<P style="text-align: center; color:red; background-color:white; font-weight:bold">Your Hanzo Studio is too OUTDATED!!!</P>' + markdown_content
|
|
1144 except:
|
|
1145 pass
|
|
1146
|
|
1147 return web.Response(text=markdown_content, status=200)
|
|
1148 else:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-32">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1162<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1158 return web.Response(status=403)
|
|
1159
|
|
1160 try:
|
|
1161 sys.stdout.close_log()
|
|
1162 except Exception as e:
|
|
1163 pass
|
|
1164
|
|
1165 if '__COMFY_CLI_SESSION__' in os.environ:
|
|
1166 with open(os.path.join(os.environ['__COMFY_CLI_SESSION__'] + '.reboot'), 'w') as file:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-33">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_no_shell: </b> Starting a process without a shell.<br>
|
|
<b>Test ID:</b> B606<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1174<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1170 exit(0)
|
|
1171
|
|
1172 print(f"\nRestarting... [Legacy Mode]\n\n")
|
|
1173 if sys.platform.startswith('win32'):
|
|
1174 return os.execv(sys.executable, ['"' + sys.executable + '"', '"' + sys.argv[0] + '"'] + sys.argv[1:])
|
|
1175 else:
|
|
1176 return os.execv(sys.executable, [sys.executable] + sys.argv)
|
|
1177
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-34">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_no_shell: </b> Starting a process without a shell.<br>
|
|
<b>Test ID:</b> B606<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1176<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1172 print(f"\nRestarting... [Legacy Mode]\n\n")
|
|
1173 if sys.platform.startswith('win32'):
|
|
1174 return os.execv(sys.executable, ['"' + sys.executable + '"', '"' + sys.argv[0] + '"'] + sys.argv[1:])
|
|
1175 else:
|
|
1176 return os.execv(sys.executable, [sys.executable] + sys.argv)
|
|
1177
|
|
1178
|
|
1179 def sanitize_filename(input_string):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-35">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1473<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1469 except:
|
|
1470 # for now, pick the first output
|
|
1471 output_to_share = potential_outputs[0]
|
|
1472
|
|
1473 assert output_to_share['type'] in ('image', 'output')
|
|
1474 output_dir = folder_paths.get_output_directory()
|
|
1475
|
|
1476 if output_to_share['type'] == 'image':
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-36">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1510<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1506 "workflowJsonFileName": 'workflow.json',
|
|
1507 "workflowJsonFileType": 'application/json',
|
|
1508 },
|
|
1509 ) as resp:
|
|
1510 assert resp.status == 200
|
|
1511 presigned_urls_json = await resp.json()
|
|
1512 assetFilePresignedUrl = presigned_urls_json["assetFilePresignedUrl"]
|
|
1513 assetFileKey = presigned_urls_json["assetFileKey"]
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-37">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1520<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1516
|
|
1517 # upload asset
|
|
1518 async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=False)) as session:
|
|
1519 async with session.put(assetFilePresignedUrl, data=open(asset_filepath, "rb")) as resp:
|
|
1520 assert resp.status == 200
|
|
1521
|
|
1522 # upload workflow json
|
|
1523 async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=False)) as session:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-38">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1525<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1521
|
|
1522 # upload workflow json
|
|
1523 async with aiohttp.ClientSession(trust_env=True, connector=aiohttp.TCPConnector(verify_ssl=False)) as session:
|
|
1524 async with session.put(workflowJsonFilePresignedUrl, data=json.dumps(prompt['workflow']).encode('utf-8')) as resp:
|
|
1525 assert resp.status == 200
|
|
1526
|
|
1527 model_filenames = extract_model_file_names(prompt['workflow'])
|
|
1528 model_file_paths = find_file_paths(folder_paths.base_path, model_filenames)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-39">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/glob/manager_server.py" target="_blank">/custom_nodes/Hanzo Manager/glob/manager_server.py</a><br>
|
|
<b>Line number: </b>1560<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1556 async with session.post(
|
|
1557 f"{share_endpoint}/upload_workflow",
|
|
1558 data=form,
|
|
1559 ) as resp:
|
|
1560 assert resp.status == 200
|
|
1561 upload_workflow_json = await resp.json()
|
|
1562 workflowId = upload_workflow_json["workflowId"]
|
|
1563
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-40">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>3<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import datetime
|
|
2 import os
|
|
3 import subprocess
|
|
4 import sys
|
|
5 import atexit
|
|
6 import threading
|
|
7 import re
|
|
8 import locale
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-41">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>54<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
50 default_conf = config['default']
|
|
51
|
|
52 if 'file_logging' in default_conf and default_conf['file_logging'].lower() == 'false':
|
|
53 enable_file_logging = False
|
|
54 except Exception:
|
|
55 pass
|
|
56
|
|
57
|
|
58 check_file_logging()
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-42">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>108<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
104 def write_stderr(self, msg):
|
|
105 for v in self.hooks.values():
|
|
106 try:
|
|
107 v.write_stderr(msg)
|
|
108 except Exception:
|
|
109 pass
|
|
110
|
|
111 def write_stdout(self, msg):
|
|
112 for v in self.hooks.values():
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-43">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>115<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
111 def write_stdout(self, msg):
|
|
112 for v in self.hooks.values():
|
|
113 try:
|
|
114 v.write_stdout(msg)
|
|
115 except Exception:
|
|
116 pass
|
|
117
|
|
118
|
|
119 terminal_hook = TerminalHook()
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-44">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>139<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
135 print(prefix, msg, end="")
|
|
136
|
|
137
|
|
138 def process_wrap(cmd_str, cwd_path, handler=None):
|
|
139 process = subprocess.Popen(cmd_str, cwd=cwd_path, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1)
|
|
140
|
|
141 if handler is None:
|
|
142 handler = handle_stream
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-45">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>311<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
307 requirements_path = os.path.join(my_path, "requirements.txt")
|
|
308
|
|
309 print(f"## Hanzo Manager: installing dependencies. (GitPython)")
|
|
310 try:
|
|
311 result = subprocess.check_output([sys.executable, '-s', '-m', 'pip', 'install', '-r', requirements_path])
|
|
312 except subprocess.CalledProcessError as e:
|
|
313 print(f"## [ERROR] Hanzo Manager: Attempting to reinstall dependencies using an alternative method.")
|
|
314 try:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-46">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>315<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
311 result = subprocess.check_output([sys.executable, '-s', '-m', 'pip', 'install', '-r', requirements_path])
|
|
312 except subprocess.CalledProcessError as e:
|
|
313 print(f"## [ERROR] Hanzo Manager: Attempting to reinstall dependencies using an alternative method.")
|
|
314 try:
|
|
315 result = subprocess.check_output([sys.executable, '-s', '-m', 'pip', 'install', '--user', '-r', requirements_path])
|
|
316 except subprocess.CalledProcessError as e:
|
|
317 print(f"## [ERROR] Hanzo Manager: Failed to install the GitPython package in the correct Python environment. Please install it manually in the appropriate environment. (You can seek help at https://app.element.io/#/room/%23hanzo_studio_space%3Amatrix.org)")
|
|
318
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-47">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>351<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
347 items = default_conf['downgrade_blacklist'].split(',')
|
|
348 items = [x.strip() for x in items if x != '']
|
|
349 cm_global.pip_downgrade_blacklist += items
|
|
350 cm_global.pip_downgrade_blacklist = list(set(cm_global.pip_downgrade_blacklist))
|
|
351 except:
|
|
352 pass
|
|
353
|
|
354
|
|
355 read_downgrade_blacklist()
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-48">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>370<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
366
|
|
367 if 'bypass_ssl' in default_conf and default_conf['bypass_ssl'].lower() == 'true':
|
|
368 print(f"[Hanzo Manager] WARN: Unsafe - SSL verification bypass option is Enabled. (see Hanzo Manager/config.ini)")
|
|
369 ssl._create_default_https_context = ssl._create_unverified_context # SSL certificate error fix.
|
|
370 except Exception:
|
|
371 pass
|
|
372
|
|
373
|
|
374 check_bypass_ssl()
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-49">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>388<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
384 global pip_map
|
|
385
|
|
386 if pip_map is None:
|
|
387 try:
|
|
388 result = subprocess.check_output([sys.executable, '-m', 'pip', 'list'], universal_newlines=True)
|
|
389
|
|
390 pip_map = {}
|
|
391 for line in result.split('\n'):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-50">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
|
|
<b>Test ID:</b> B307<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>544<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
540
|
|
541 executed.add(line)
|
|
542
|
|
543 try:
|
|
544 script = eval(line)
|
|
545
|
|
546 if script[1].startswith('#') and script[1] != '#FORCE':
|
|
547 if script[1] == "#LAZY-INSTALL-SCRIPT":
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-51">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/prestartup_script.py" target="_blank">/custom_nodes/Hanzo Manager/prestartup_script.py</a><br>
|
|
<b>Line number: </b>597<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
593 asyncio.set_event_loop_policy(asyncio.windows_events.WindowsSelectorEventLoopPolicy())
|
|
594 print(f"[Hanzo Manager] Windows event loop policy mode enabled")
|
|
595 except Exception as e:
|
|
596 print(f"[Hanzo Manager] WARN: Windows initialization fail: {e}")
|
|
597 except Exception:
|
|
598 pass
|
|
599
|
|
600
|
|
601 if platform.system() == 'Windows':
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-52">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py" target="_blank">/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py</a><br>
|
|
<b>Line number: </b>2<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import os
|
|
2 import subprocess
|
|
3
|
|
4
|
|
5 def get_enabled_subdirectories_with_files(base_directory):
|
|
6 subdirs_with_files = []
|
|
7 for subdir in os.listdir(base_directory):
|
|
8 try:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-53">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py" target="_blank">/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py</a><br>
|
|
<b>Line number: </b>25<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
21
|
|
22
|
|
23 def install_requirements(requirements_file_path):
|
|
24 if os.path.exists(requirements_file_path):
|
|
25 subprocess.run(["pip", "install", "-r", requirements_file_path])
|
|
26
|
|
27
|
|
28 def run_install_script(install_script_path):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-54">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py" target="_blank">/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py</a><br>
|
|
<b>Line number: </b>25<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
21
|
|
22
|
|
23 def install_requirements(requirements_file_path):
|
|
24 if os.path.exists(requirements_file_path):
|
|
25 subprocess.run(["pip", "install", "-r", requirements_file_path])
|
|
26
|
|
27
|
|
28 def run_install_script(install_script_path):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-55">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py" target="_blank">/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py</a><br>
|
|
<b>Line number: </b>30<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
26
|
|
27
|
|
28 def run_install_script(install_script_path):
|
|
29 if os.path.exists(install_script_path):
|
|
30 subprocess.run(["python", install_script_path])
|
|
31
|
|
32
|
|
33 custom_nodes_directory = "custom_nodes"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-56">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py" target="_blank">/custom_nodes/Hanzo Manager/scripts/colab-dependencies.py</a><br>
|
|
<b>Line number: </b>30<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
26
|
|
27
|
|
28 def run_install_script(install_script_path):
|
|
29 if os.path.exists(install_script_path):
|
|
30 subprocess.run(["python", install_script_path])
|
|
31
|
|
32
|
|
33 custom_nodes_directory = "custom_nodes"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|