mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
zeekay
84ca3e48e7
Fix Python/JS identifiers that had spaces inserted by the ComfyUI → Hanzo Studio replacement (e.g. class names, variable prefixes). Spaces in identifiers cause syntax errors.
203 lines
6.6 KiB
HTML
203 lines
6.6 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">482</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>hardcoded_password_default: </b> Possible hardcoded password: 'none'<br>
|
|
<b>Test ID:</b> B107<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/259.html" target="_blank">CWE-259</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_Cutoff/cutoff.py" target="_blank">/custom_nodes/HanzoStudio_Cutoff/cutoff.py</a><br>
|
|
<b>Line number: </b>217<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b107_hardcoded_password_default.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b107_hardcoded_password_default.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
213 return emb, pool
|
|
214 else:
|
|
215 return emb
|
|
216
|
|
217 def finalize_clip_regions(clip_regions, mask_token, strict_mask, start_from_masked, token_normalization='none', weight_interpretation='comfy'):
|
|
218 clip = clip_regions["clip"]
|
|
219 tokenizer = clip.tokenizer
|
|
220 if hasattr(tokenizer, 'clip_g'):
|
|
221 tokenizer = tokenizer.clip_g
|
|
222 base_weighted_tokens = clip_regions["base_tokens"]
|
|
223
|
|
224 #calc base embedding
|
|
225 base_embedding_full, pool = encode_from_tokens(clip, base_weighted_tokens, token_normalization, weight_interpretation, True)
|
|
226
|
|
227 # Avoid numpy value error and passthrough base embeddings if no regions are set.
|
|
228 if len(clip_regions["regions"]) == 0:
|
|
229 return ([[base_embedding_full, {"pooled_output": pool}]], )
|
|
230
|
|
231 if mask_token == "":
|
|
232 mask_token = 266#clip.tokenizer.end_token
|
|
233 else:
|
|
234 mask_token = tokenizer.tokenizer(mask_token)['input_ids'][1:-1]
|
|
235 if len(mask_token) > 1:
|
|
236 warnings.warn("mask_token does not map to a single token, using the first token instead")
|
|
237 mask_token = mask_token[0]
|
|
238
|
|
239 #calc global target mask
|
|
240 global_target_mask = np.any(np.stack(clip_regions["targets"]), axis=0).astype(int)
|
|
241
|
|
242 #calc global region mask
|
|
243 global_region_mask = np.any(np.stack(clip_regions["regions"]), axis=0).astype(float)
|
|
244 regions_sum = np.sum(np.stack(clip_regions["regions"]), axis=0)
|
|
245 regions_normalized = np.divide(1, regions_sum, out=np.zeros_like(regions_sum), where=regions_sum!=0)
|
|
246
|
|
247 #mask base embeddings
|
|
248 base_embedding_masked = encode_from_tokens(clip, create_masked_prompt(base_weighted_tokens, global_target_mask, mask_token), token_normalization, weight_interpretation)
|
|
249 base_embedding_start = base_embedding_full * (1-start_from_masked) + base_embedding_masked * start_from_masked
|
|
250 base_embedding_outer = base_embedding_full * (1-strict_mask) + base_embedding_masked * strict_mask
|
|
251
|
|
252 region_embeddings = []
|
|
253 for region, target, weight in zip (clip_regions["regions"],clip_regions["targets"],clip_regions["weights"]):
|
|
254 region_masking = torch.tensor(regions_normalized * region * weight, dtype=base_embedding_full.dtype, device=base_embedding_full.device).unsqueeze(-1)
|
|
255
|
|
256 region_emb = encode_from_tokens(clip, create_masked_prompt(base_weighted_tokens, global_target_mask - target, mask_token), token_normalization, weight_interpretation)
|
|
257 region_emb -= base_embedding_start
|
|
258 region_emb *= region_masking
|
|
259
|
|
260 region_embeddings.append(region_emb)
|
|
261 region_embeddings = torch.stack(region_embeddings).sum(axis=0)
|
|
262
|
|
263 embeddings_final_mask = torch.tensor(global_region_mask, dtype=base_embedding_full.dtype, device=base_embedding_full.device).unsqueeze(-1)
|
|
264 embeddings_final = base_embedding_start * embeddings_final_mask + base_embedding_outer * (1 - embeddings_final_mask)
|
|
265 embeddings_final += region_embeddings
|
|
266 return ([[embeddings_final, {"pooled_output": pool}]], )
|
|
267
|
|
268
|
|
269 class CLIPRegionsToConditioning:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>hardcoded_password_string: </b> Possible hardcoded password: ''<br>
|
|
<b>Test ID:</b> B105<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/259.html" target="_blank">CWE-259</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_Cutoff/cutoff.py" target="_blank">/custom_nodes/HanzoStudio_Cutoff/cutoff.py</a><br>
|
|
<b>Line number: </b>231<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b105_hardcoded_password_string.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b105_hardcoded_password_string.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
227 # Avoid numpy value error and passthrough base embeddings if no regions are set.
|
|
228 if len(clip_regions["regions"]) == 0:
|
|
229 return ([[base_embedding_full, {"pooled_output": pool}]], )
|
|
230
|
|
231 if mask_token == "":
|
|
232 mask_token = 266#clip.tokenizer.end_token
|
|
233 else:
|
|
234 mask_token = tokenizer.tokenizer(mask_token)['input_ids'][1:-1]
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|