Files
custom-nodes-security-scan/docs/ComfyUI-Prompt-MZ-bandit.html
zeekay 6bdea42e64 rebrand: Hanzo AI Inc — full rebrand from ComfyUI/Comfy-Org
- Updated copyright to Hanzo AI, Inc.
- Replaced ComfyUI references with Hanzo Studio
- Updated GitHub org URLs (Comfy-Org → hanzoui)
- Updated domains (comfy.org → hanzo.ai)
- Updated package names and npm scopes
- Updated LICENSE with Hanzo AI copyright header
2026-02-23 10:54:25 -08:00

1039 lines
40 KiB
HTML

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>
Bandit Report
</title>
<style>
html * {
font-family: "Arial", sans-serif;
}
pre {
font-family: "Monaco", monospace;
}
.bordered-box {
border: 1px solid black;
padding-top:.5em;
padding-bottom:.5em;
padding-left:1em;
}
.metrics-box {
font-size: 1.1em;
line-height: 130%;
}
.metrics-title {
font-size: 1.5em;
font-weight: 500;
margin-bottom: .25em;
}
.issue-description {
font-size: 1.3em;
font-weight: 500;
}
.candidate-issues {
margin-left: 2em;
border-left: solid 1px; LightGray;
padding-left: 5%;
margin-top: .2em;
margin-bottom: .2em;
}
.issue-block {
border: 1px solid LightGray;
padding-left: .5em;
padding-top: .5em;
padding-bottom: .5em;
margin-bottom: .5em;
}
.issue-sev-high {
background-color: Pink;
}
.issue-sev-medium {
background-color: NavajoWhite;
}
.issue-sev-low {
background-color: LightCyan;
}
</style>
</head>
<body>
<div id="metrics">
<div class="metrics-box bordered-box">
<div class="metrics-title">
Metrics:<br>
</div>
Total lines of code: <span id="loc">6495</span><br>
Total lines skipped (#nosec): <span id="nosec">0</span>
</div>
</div>
<br>
<div id="results">
<div id="issue-0">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/half_json.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/half_json.py</a><br>
<b>Line number: </b>28<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
24 def fix(self, line: str, *, strict: bool = True) -&gt; FixResult:
25 try:
26 json.loads(line, strict=strict)
27 return FixResult(success=True, line=line, origin=True)
28 except Exception:
29 pass
30
31 ok, new_line = self.fixwithtry(line, strict=strict)
32 return FixResult(success=ok, line=new_line, origin=False)
</pre>
</div>
</div>
</div>
<div id="issue-1">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/half_json.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/half_json.py</a><br>
<b>Line number: </b>289<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
285 &quot;&quot;&quot;
286
287
288 def errmsg_inv(e: ValueError) -&gt; Dict[str, Any]:
289 assert isinstance(e, PyJSONDecodeError)
290 parser = e.__dict__.get(&quot;parser&quot;, &quot;&quot;)
291 errmsg = e.msg
292 localerr = errors.get_decode_error(parser, errmsg)
</pre>
</div>
</div>
</div>
<div id="issue-2">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>152<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
148 Returns a tensor of with the same dimensions as the input: i.e.,
149 [1, T, D] or [T, D].
150 &quot;&quot;&quot;
151 shape_len = len(seq_embeds.shape)
152 assert 2 &lt;= shape_len &lt;= 3
153 len_seq = seq_embeds.size(-2)
154 assert len_seq &lt;= self.max_seq_len
155 pos_embeds = self.pos_idx_to_embed[0:seq_embeds.size(-2), :]
</pre>
</div>
</div>
</div>
<div id="issue-3">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>154<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
150 &quot;&quot;&quot;
151 shape_len = len(seq_embeds.shape)
152 assert 2 &lt;= shape_len &lt;= 3
153 len_seq = seq_embeds.size(-2)
154 assert len_seq &lt;= self.max_seq_len
155 pos_embeds = self.pos_idx_to_embed[0:seq_embeds.size(-2), :]
156 # Adapt pre-computed positional embeddings to the input.
157 if shape_len == 3:
</pre>
</div>
</div>
</div>
<div id="issue-4">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>193<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
189 Returns a tensor of with the same dimensions as the input: i.e.,
190 [1, T, D] or [T, D].
191 &quot;&quot;&quot;
192 shape_len = len(seq_embeds.shape)
193 assert 2 &lt;= shape_len &lt;= 3
194 len_seq = seq_embeds.size(-2)
195 assert len_seq &lt;= self.num_pos
196 # [T, D]
</pre>
</div>
</div>
</div>
<div id="issue-5">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>195<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
191 &quot;&quot;&quot;
192 shape_len = len(seq_embeds.shape)
193 assert 2 &lt;= shape_len &lt;= 3
194 len_seq = seq_embeds.size(-2)
195 assert len_seq &lt;= self.num_pos
196 # [T, D]
197 pos_embeds = self.embeddings(
198 torch.arange(len_seq).to(seq_embeds.device))
</pre>
</div>
</div>
</div>
<div id="issue-6">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>281<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
277
278 def forward(self, x, size):
279 B, N, C = x.shape
280 H, W = size
281 assert N == H * W
282
283 x = self.dw(x.transpose(1, 2).view(B, C, H, W))
284 size = (x.size(-2), x.size(-1))
</pre>
</div>
</div>
</div>
<div id="issue-7">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>439<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
435 def forward(self, x, size):
436
437 H, W = size
438 B, L, C = x.shape
439 assert L == H * W, &quot;input feature has wrong size&quot;
440
441 x = x.view(B, H, W, C)
442
</pre>
</div>
</div>
</div>
<div id="issue-8">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>570<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
566 self.num_heads = num_heads
567 self.num_groups = num_groups
568 self.num_stages = len(self.embed_dims)
569 self.enable_checkpoint = enable_checkpoint
570 assert self.num_stages == len(self.num_heads) == len(self.num_groups)
571
572 num_stages = len(embed_dims)
573 dpr = [x.item() for x in torch.linspace(
</pre>
</div>
</div>
</div>
<div id="issue-9">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>2495<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
2491 )
2492 class Florence2VisionModel(Florence2PreTrainedModel):
2493 def __init__(self, config: Florence2VisionConfig):
2494 super().__init__(config)
2495 assert config.model_type == &#x27;davit&#x27;, &#x27;only DaViT is supported for now&#x27;
2496 self.vision_tower = DaViT.from_config(config=config)
2497
2498 self.post_init()
</pre>
</div>
</div>
</div>
<div id="issue-10">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>2515<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
2511 )
2512 class Florence2VisionModelWithProjection(Florence2PreTrainedModel):
2513 def __init__(self, config: Florence2VisionConfig):
2514 super().__init__(config)
2515 assert config.model_type == &#x27;davit&#x27;, &#x27;only DaViT is supported for now&#x27;
2516 self.vision_tower = DaViT.from_config(config=config)
2517
2518 self._build_image_projection_layers(config)
</pre>
</div>
</div>
</div>
<div id="issue-11">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>2562<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
2558 if self.image_pos_embed is not None:
2559 x = x.view(batch_size * T, -1, x.shape[-1])
2560 num_tokens = x.shape[-2]
2561 h, w = int(num_tokens ** 0.5), int(num_tokens ** 0.5)
2562 assert h * w == num_tokens, &#x27;only support square feature maps for now&#x27;
2563 x = x.view(batch_size * T, h, w, x.shape[-1])
2564 pos_embed = self.image_pos_embed(x)
2565 x = x + pos_embed
</pre>
</div>
</div>
</div>
<div id="issue-12">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>2608<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
2604 )
2605 class Florence2ForConditionalGeneration(Florence2PreTrainedModel):
2606 def __init__(self, config: Florence2Config):
2607 super().__init__(config)
2608 assert config.vision_config.model_type == &#x27;davit&#x27;, &#x27;only DaViT is supported for now&#x27;
2609 del config.vision_config.model_type
2610 self.vision_tower = DaViT.from_config(config=config.vision_config)
2611 # remove unused layers
</pre>
</div>
</div>
</div>
<div id="issue-13">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/hook/modeling_florence2.py</a><br>
<b>Line number: </b>2688<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
2684 if self.image_pos_embed is not None:
2685 x = x.view(batch_size * T, -1, x.shape[-1])
2686 num_tokens = x.shape[-2]
2687 h, w = int(num_tokens ** 0.5), int(num_tokens ** 0.5)
2688 assert h * w == num_tokens, &#x27;only support square feature maps for now&#x27;
2689 x = x.view(batch_size * T, h, w, x.shape[-1])
2690 pos_embed = self.image_pos_embed(x)
2691 x = x + pos_embed
</pre>
</div>
</div>
</div>
<div id="issue-14">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_gen_translate.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_gen_translate.py</a><br>
<b>Line number: </b>104<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
100 widget_name_zh = widget_name
101 for k, v in ZH_Replace_Map.items():
102 widget_name_zh = widget_name_zh.replace(k, v)
103 nodes[key][&quot;outputs&quot;][widget_name] = widget_name_zh
104 except:
105 pass
106
107 with open(translation_config, &quot;w&quot;, encoding=&quot;utf-8&quot;) as f:
108 f.write(json.dumps(nodes, indent=4, ensure_ascii=False))
</pre>
</div>
</div>
</div>
<div id="issue-15">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py</a><br>
<b>Line number: </b>6<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
2 import importlib
3 import json
4 import os
5 import shutil
6 import subprocess
7 import sys
8 import torch
9 try:
</pre>
</div>
</div>
</div>
<div id="issue-16">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py</a><br>
<b>Line number: </b>75<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
71
72 print(f&quot;pip install {wheel_url}&quot;)
73 modelscope_url = f&quot;https://www.modelscope.cn/api/v1/models/wailovet/MinusZoneAIModels/repo?Revision=master&amp;FilePath=llama-cpp-python-win%2F{cuda_version}%2F{wheel_name}&quot;
74 if mz_prompt_utils.Utils.testDownloadSpeed(wheel_url):
75 ret = subprocess.run([
76 sys.executable, &quot;-m&quot;,
77 &quot;pip&quot;, &quot;install&quot;, wheel_url], check=True)
78 elif mz_prompt_utils.Utils.testDownloadSpeed(modelscope_url):
79 import tempfile
80 whl_download_file = os.path.join(
</pre>
</div>
</div>
</div>
<div id="issue-17">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py</a><br>
<b>Line number: </b>85<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
81 tempfile.gettempdir(), wheel_name)
82 mz_prompt_utils.Utils.download_file(
83 modelscope_url, whl_download_file)
84 print(f&quot;pip install {whl_download_file}&quot;)
85 ret = subprocess.run([
86 sys.executable, &quot;-m&quot;,
87 &quot;pip&quot;, &quot;install&quot;, whl_download_file], check=True)
88 else:
89
90 # 兜底方案
</pre>
</div>
</div>
</div>
<div id="issue-18">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py</a><br>
<b>Line number: </b>99<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
95 tempfile.gettempdir(), wheel_name)
96 mz_prompt_utils.Utils.download_file(
97 modelscope_url, whl_download_file)
98 print(f&quot;pip install {whl_download_file}&quot;)
99 ret = subprocess.run([
100 sys.executable, &quot;-m&quot;,
101 &quot;pip&quot;, &quot;install&quot;, whl_download_file], check=True)
102 else:
103 ret = subprocess.run([
104 sys.executable, &quot;-m&quot;,
</pre>
</div>
</div>
</div>
<div id="issue-19">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_llama_cpp.py</a><br>
<b>Line number: </b>103<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
99 ret = subprocess.run([
100 sys.executable, &quot;-m&quot;,
101 &quot;pip&quot;, &quot;install&quot;, whl_download_file], check=True)
102 else:
103 ret = subprocess.run([
104 sys.executable, &quot;-m&quot;,
105 &quot;pip&quot;, &quot;install&quot;, wheel_url], check=True)
106
107 if ret.returncode != 0:
108 raise ValueError(&quot;Failed to install llama_cpp. (安装llama_cpp失败)&quot;)
</pre>
</div>
</div>
</div>
<div id="issue-20">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_openaiapi.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_openaiapi.py</a><br>
<b>Line number: </b>4<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1 import os
2 import sys
3 import json
4 import subprocess
5
6 from . import mz_prompt_utils
7 from . import mz_llama_cpp
8 from . import mz_llama_core_nodes
</pre>
</div>
</div>
</div>
<div id="issue-21">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_openaiapi.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_openaiapi.py</a><br>
<b>Line number: </b>35<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
31 try:
32 from openai import OpenAI
33 import openai
34 except ImportError:
35 subprocess.check_call(
36 [sys.executable, &quot;-m&quot;, &quot;pip&quot;, &quot;install&quot;, &quot;openai&quot;])
37 from openai import OpenAI
38 import openai
39
</pre>
</div>
</div>
</div>
<div id="issue-22">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>5<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1
2 import json
3 import os
4 import shutil
5 import subprocess
6 import sys
7 import threading
8 import time
</pre>
</div>
</div>
</div>
<div id="issue-23">
<div class="issue-block issue-sev-high">
<b>hashlib: </b> Use of weak MD5 hash for security. Consider usedforsecurity=False<br>
<b>Test ID:</b> B324<br>
<b>Severity: </b>HIGH<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/327.html" target="_blank">CWE-327</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>30<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b324_hashlib.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b324_hashlib.html</a><br>
<div class="code">
<pre>
26
27
28 class Utils:
29 def Md5(str):
30 return hashlib.md5(str.encode(&#x27;utf-8&#x27;)).hexdigest()
31
32 def check_frames_path(frames_path):
33
</pre>
</div>
</div>
</div>
<div id="issue-24">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>191<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
187 try:
188 import argostranslate
189 from argostranslate import translate, package
190 except ImportError:
191 subprocess.run([
192 sys.executable, &quot;-m&quot;,
193 &quot;pip&quot;, &quot;install&quot;, &quot;argostranslate&quot;], check=True)
194
195 try:
196 import argostranslate
</pre>
</div>
</div>
</div>
<div id="issue-25">
<div class="issue-block issue-sev-medium">
<b>request_without_timeout: </b> Requests call without timeout<br>
<b>Test ID:</b> B113<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>LOW<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>426<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
<div class="code">
<pre>
422 def get_device():
423 return comfy.model_management.get_torch_device()
424
425 def download_small_file(url, filepath):
426 response = requests.get(url)
427 os.makedirs(os.path.dirname(filepath), exist_ok=True)
428 with open(filepath, &quot;wb&quot;) as f:
429 f.write(response.content)
</pre>
</div>
</div>
</div>
<div id="issue-26">
<div class="issue-block issue-sev-medium">
<b>request_without_timeout: </b> Requests call without timeout<br>
<b>Test ID:</b> B113<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>LOW<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>434<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
<div class="code">
<pre>
430 return filepath
431
432 def download_file(url, filepath, threads=8, retries=6):
433
434 get_size_tmp = requests.get(url, stream=True)
435 total_size = int(get_size_tmp.headers.get(&quot;content-length&quot;, 0))
436
437 print(f&quot;Downloading {url} to {filepath} with size {total_size} bytes&quot;)
</pre>
</div>
</div>
</div>
<div id="issue-27">
<div class="issue-block issue-sev-medium">
<b>request_without_timeout: </b> Requests call without timeout<br>
<b>Test ID:</b> B113<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>LOW<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>489<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
<div class="code">
<pre>
485 continue
486 # print(f&quot;Downloading {cache_filepath} with headers bytes={start + existing_size}-{end}&quot;)
487
488 # Streaming, so we can iterate over the response.
489 response = requests.get(url, stream=True, headers=headers)
490
491 def download_file_thread(response, cache_filepath):
492 block_size = 1024
</pre>
</div>
</div>
</div>
<div id="issue-28">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>822<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
818 cache_json[key] = value
819
820 with open(cache_json_file, &quot;w&quot;, encoding=&quot;utf-8&quot;) as f:
821 json.dump(cache_json, f, indent=4)
822 except:
823 pass
824
825 def file_sha256(file_path):
826 # 获取文件的更新时间
</pre>
</div>
</div>
</div>
<div id="issue-29">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_prompt_utils.py</a><br>
<b>Line number: </b>910<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
906 source_model_zoo_json = []
907 try:
908 with open(source_model_zoo_file, &quot;r&quot;, encoding=&quot;utf-8&quot;) as f:
909 source_model_zoo_json = json.load(f)
910 except:
911 pass
912
913 # Utils.print_log(f&quot;source_model_zoo_json: {json.dumps(source_model_zoo_json, indent=4)}&quot;)
914 if tags_filter is not None:
</pre>
</div>
</div>
</div>
<div id="issue-30">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_transformers.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_transformers.py</a><br>
<b>Line number: </b>4<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1 import json
2 import os
3 import shutil
4 import subprocess
5 import traceback
6
7
8 def transformers_captioner(args_dict, myfunc):
</pre>
</div>
</div>
</div>
<div id="issue-31">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_transformers.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_transformers.py</a><br>
<b>Line number: </b>197<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
193 if not os.path.exists(model_path):
194 # GIT_LFS_SKIP_SMUDGE=1 git clone https://www.modelscope.cn/AI-ModelScope/Florence-2-large.git
195 original_env = os.environ.get(&quot;GIT_LFS_SKIP_SMUDGE&quot;)
196 os.environ[&quot;GIT_LFS_SKIP_SMUDGE&quot;] = &quot;1&quot;
197 subprocess.run(
198 [&quot;git&quot;, &quot;clone&quot;, &quot;https://www.modelscope.cn/AI-ModelScope/Florence-2-large.git&quot;, model_path])
199 if original_env is not None:
200 os.environ[&quot;GIT_LFS_SKIP_SMUDGE&quot;] = original_env
201
</pre>
</div>
</div>
</div>
<div id="issue-32">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/Hanzo Studio-Prompt-MZ/mz_transformers.py" target="_blank">/custom_nodes/Hanzo Studio-Prompt-MZ/mz_transformers.py</a><br>
<b>Line number: </b>197<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
193 if not os.path.exists(model_path):
194 # GIT_LFS_SKIP_SMUDGE=1 git clone https://www.modelscope.cn/AI-ModelScope/Florence-2-large.git
195 original_env = os.environ.get(&quot;GIT_LFS_SKIP_SMUDGE&quot;)
196 os.environ[&quot;GIT_LFS_SKIP_SMUDGE&quot;] = &quot;1&quot;
197 subprocess.run(
198 [&quot;git&quot;, &quot;clone&quot;, &quot;https://www.modelscope.cn/AI-ModelScope/Florence-2-large.git&quot;, model_path])
199 if original_env is not None:
200 os.environ[&quot;GIT_LFS_SKIP_SMUDGE&quot;] = original_env
201
</pre>
</div>
</div>
</div>
</div>
</body>
</html>