mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
zeekay
6bdea42e64
- Updated copyright to Hanzo AI, Inc. - Replaced ComfyUI references with Hanzo Studio - Updated GitHub org URLs (Comfy-Org → hanzoui) - Updated domains (comfy.org → hanzo.ai) - Updated package names and npm scopes - Updated LICENSE with Hanzo AI copyright header
467 lines
18 KiB
HTML
467 lines
18 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">1710</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py</a><br>
|
|
<b>Line number: </b>4<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import os
|
|
2 import sys
|
|
3 import json
|
|
4 import subprocess
|
|
5 import numpy as np
|
|
6 import re
|
|
7 import datetime
|
|
8 from typing import List
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py</a><br>
|
|
<b>Line number: </b>84<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
80 video_format_path = folder_paths.get_full_path("VHS_video_formats", format_name + ".json")
|
|
81 with open(video_format_path, 'r') as stream:
|
|
82 video_format = json.load(stream)
|
|
83 for w in gen_format_widgets(video_format):
|
|
84 assert(w[0][0] in kwargs)
|
|
85 w[0] = str(kwargs[w[0][0]])
|
|
86 return video_format
|
|
87
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py</a><br>
|
|
<b>Line number: </b>116<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
112 with open(metadata_path, "w") as f:
|
|
113 f.write(";FFMETADATA1\n")
|
|
114 f.write(metadata)
|
|
115 m_args = args[:1] + ["-i", metadata_path] + args[1:] + ["-metadata", "creation_time=now"]
|
|
116 with subprocess.Popen(m_args + [file_path], stderr=subprocess.PIPE,
|
|
117 stdin=subprocess.PIPE, env=env) as proc:
|
|
118 try:
|
|
119 while frame_data is not None:
|
|
120 proc.stdin.write(frame_data)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py</a><br>
|
|
<b>Line number: </b>138<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
134 #Res was not set
|
|
135 print(err.decode("utf-8"), end="", file=sys.stderr)
|
|
136 logger.warn("An error occurred when saving with metadata")
|
|
137 if res != b'':
|
|
138 with subprocess.Popen(args + [file_path], stderr=subprocess.PIPE,
|
|
139 stdin=subprocess.PIPE, env=env) as proc:
|
|
140 try:
|
|
141 while frame_data is not None:
|
|
142 proc.stdin.write(frame_data)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py</a><br>
|
|
<b>Line number: </b>396<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
392 gif_output_path = os.path.join( full_output_folder, gif_output)
|
|
393 gifski_args = [gifski_path] + video_format["gifski_pass"] \
|
|
394 + ["-o", gif_output_path, file_path]
|
|
395 try:
|
|
396 res = subprocess.run(gifski_args, env=env, check=True, capture_output=True)
|
|
397 except subprocess.CalledProcessError as e:
|
|
398 raise Exception("An error occured in the gifski subprocess:\n" \
|
|
399 + e.stderr.decode("utf-8"))
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py</a><br>
|
|
<b>Line number: </b>426<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
422 + video_format["audio_pass"] \
|
|
423 + ["-af", "apad", "-shortest", output_file_with_audio_path]
|
|
424
|
|
425 try:
|
|
426 res = subprocess.run(mux_args, input=audio(), env=env,
|
|
427 capture_output=True, check=True)
|
|
428 except subprocess.CalledProcessError as e:
|
|
429 raise Exception("An error occured in the ffmpeg subprocess:\n" \
|
|
430 + e.stderr.decode("utf-8"))
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/nodes.py</a><br>
|
|
<b>Line number: </b>542<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
538
|
|
539 def prune_outputs(self, filenames, options):
|
|
540 if len(filenames[1]) == 0:
|
|
541 return ()
|
|
542 assert(len(filenames[1]) <= 3 and len(filenames[1]) >= 2)
|
|
543 delete_list = []
|
|
544 if options in ["Intermediate", "Intermediate and Utility", "All"]:
|
|
545 delete_list += filenames[1][1:-1]
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/server.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/server.py</a><br>
|
|
<b>Line number: </b>5<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import server
|
|
2 import folder_paths
|
|
3 import os
|
|
4 import time
|
|
5 import subprocess
|
|
6 from .utils import is_url, get_sorted_dir_files_from_directory, ffmpeg_path, validate_sequence
|
|
7 from comfy.k_diffusion.utils import FolderOfImages
|
|
8
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/server.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/server.py</a><br>
|
|
<b>Line number: </b>111<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
107
|
|
108 args += ['-c:v', 'libvpx-vp9','-deadline', 'realtime', '-cpu-used', '8', '-f', 'webm', '-']
|
|
109
|
|
110 try:
|
|
111 with subprocess.Popen(args, stdout=subprocess.PIPE) as proc:
|
|
112 try:
|
|
113 resp = web.StreamResponse()
|
|
114 resp.content_type = 'video/webm'
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py</a><br>
|
|
<b>Line number: </b>5<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import hashlib
|
|
2 import os
|
|
3 from typing import Iterable
|
|
4 import shutil
|
|
5 import subprocess
|
|
6 import re
|
|
7
|
|
8 import server
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-10">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py</a><br>
|
|
<b>Line number: </b>18<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
14 DIMMAX = 8192
|
|
15
|
|
16 def ffmpeg_suitability(path):
|
|
17 try:
|
|
18 version = subprocess.run([path, "-version"], check=True,
|
|
19 capture_output=True).stdout.decode("utf-8")
|
|
20 except:
|
|
21 return 0
|
|
22 score = 0
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-11">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py</a><br>
|
|
<b>Line number: </b>126<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
122 prompt_queue.put((number, prompt_id, prompt, extra_data, outputs_to_execute))
|
|
123
|
|
124 requeue_guard = [None, 0, 0, {}]
|
|
125 def requeue_workflow(requeue_required=(-1,True)):
|
|
126 assert(len(prompt_queue.currently_running) == 1)
|
|
127 global requeue_guard
|
|
128 (run_number, _, prompt, _, _) = next(iter(prompt_queue.currently_running.values()))
|
|
129 if requeue_guard[0] != run_number:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-12">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py" target="_blank">/custom_nodes/Hanzo Studio-VideoHelperSuite/videohelpersuite/utils.py</a><br>
|
|
<b>Line number: </b>152<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
148 args += ["-ss", str(start_time)]
|
|
149 if duration > 0:
|
|
150 args += ["-t", str(duration)]
|
|
151 try:
|
|
152 res = subprocess.run(args + ["-f", "wav", "-"],
|
|
153 stdout=subprocess.PIPE, check=True).stdout
|
|
154 except subprocess.CalledProcessError as e:
|
|
155 logger.warning(f"Failed to extract audio from: {file}")
|
|
156 return False
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|