Files
custom-nodes-security-scan/docs/ComfyUI_VLM_nodes-bandit.html
zeekay 84ca3e48e7 fix: repair broken identifiers from rebrand
Fix Python/JS identifiers that had spaces inserted by the
ComfyUI → Hanzo Studio replacement (e.g. class names, variable
prefixes). Spaces in identifiers cause syntax errors.
2026-02-23 14:50:04 -08:00

659 lines
26 KiB
HTML

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>
Bandit Report
</title>
<style>
html * {
font-family: "Arial", sans-serif;
}
pre {
font-family: "Monaco", monospace;
}
.bordered-box {
border: 1px solid black;
padding-top:.5em;
padding-bottom:.5em;
padding-left:1em;
}
.metrics-box {
font-size: 1.1em;
line-height: 130%;
}
.metrics-title {
font-size: 1.5em;
font-weight: 500;
margin-bottom: .25em;
}
.issue-description {
font-size: 1.3em;
font-weight: 500;
}
.candidate-issues {
margin-left: 2em;
border-left: solid 1px; LightGray;
padding-left: 5%;
margin-top: .2em;
margin-bottom: .2em;
}
.issue-block {
border: 1px solid LightGray;
padding-left: .5em;
padding-top: .5em;
padding-bottom: .5em;
margin-bottom: .5em;
}
.issue-sev-high {
background-color: Pink;
}
.issue-sev-medium {
background-color: NavajoWhite;
}
.issue-sev-low {
background-color: LightCyan;
}
</style>
</head>
<body>
<div id="metrics">
<div class="metrics-box bordered-box">
<div class="metrics-title">
Metrics:<br>
</div>
Total lines of code: <span id="loc">3657</span><br>
Total lines skipped (#nosec): <span id="nosec">0</span>
</div>
</div>
<br>
<div id="results">
<div id="issue-0">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/__init__.py</a><br>
<b>Line number: </b>6<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
2 import os
3 import importlib
4 import pkg_resources
5 import sys
6 import subprocess
7 import folder_paths
8
9 supported_LLava_extensions = set([&#x27;.gguf&#x27;])
</pre>
</div>
</div>
</div>
<div id="issue-1">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/__init__.py</a><br>
<b>Line number: </b>35<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
31
32 if missing_packages:
33 print(f&quot;Missing or outdated packages: {&#x27;, &#x27;.join(missing_packages)}&quot;)
34 print(&quot;Installing/Updating missing packages...&quot;)
35 subprocess.check_call([sys.executable, &#x27;-s&#x27;, &#x27;-m&#x27;, &#x27;pip&#x27;, &#x27;install&#x27;, *missing_packages])
36 else:
37 print(&quot;All packages from requirements.txt are installed and up to date.&quot;)
38
</pre>
</div>
</div>
</div>
<div id="issue-2">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
<b>Line number: </b>7<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
3 import shutil
4 from os.path import join, dirname, abspath, exists
5 from os import makedirs, symlink, readlink
6 import platform
7 import subprocess
8 import sys
9 import importlib.util
10 import re
</pre>
</div>
</div>
</div>
<div id="issue-3">
<div class="issue-block issue-sev-medium">
<b>request_without_timeout: </b> Requests call without timeout<br>
<b>Test ID:</b> B113<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>LOW<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
<b>Line number: </b>80<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
<div class="code">
<pre>
76 return system_info
77
78 def latest_lamacpp():
79 try:
80 response = get(&quot;https://api.github.com/repos/abetlen/llama-cpp-python/releases/latest&quot;)
81 return response.json()[&quot;tag_name&quot;].replace(&quot;v&quot;, &quot;&quot;)
82 except Exception:
83 return &quot;0.2.20&quot;
</pre>
</div>
</div>
</div>
<div id="issue-4">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
<b>Line number: </b>91<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
87 print(f&quot;Installing {package_name}...&quot;)
88 command = [sys.executable, &quot;-m&quot;, &quot;pip&quot;, &quot;install&quot;, package_name, &quot;--no-cache-dir&quot;]
89 if custom_command:
90 command += custom_command.split()
91 subprocess.check_call(command)
92 else:
93 print(f&quot;{package_name} is already installed.&quot;)
94
</pre>
</div>
</div>
</div>
<div id="issue-5">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
<b>Line number: </b>144<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
140
141 # Execute the installation command
142 try:
143 print(f&quot;Installing AutoGPTQ with command: {&#x27; &#x27;.join(base_command)}&quot;)
144 subprocess.check_call(base_command)
145 except Exception as e:
146 print(f&quot;Failed to install AutoGPTQ: {e}&quot;)
147
</pre>
</div>
</div>
</div>
<div id="issue-6">
<div class="issue-block issue-sev-low">
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
<b>Test ID:</b> B110<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
<b>Line number: </b>233<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
<div class="code">
<pre>
229 try:
230 import _winapi
231 _winapi.CreateJunction(src, dst)
232 return True
233 except:
234 pass
235 try:
236 os.symlink(src, dst)
237 return True
</pre>
</div>
</div>
</div>
<div id="issue-7">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>177<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
173 self.out_dim = out_dim
174 self.norm_qk = norm_qk
175 self.num_heads = num_attention_heads
176 self.head_dim = hidden_size // num_attention_heads
177 assert self.head_dim * num_attention_heads == self.embed_dim, &quot;embed_dim must be divisible by num_attention_heads&quot;
178
179 self.q_proj = nn.Linear(self.embed_dim, self.embed_dim)
180 self.kv_proj = nn.Linear(self.embed_dim, self.embed_dim * 2)
</pre>
</div>
</div>
</div>
<div id="issue-8">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>312<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
308 def sinusoidal_position_embedding(width: int, height: int, depth: int, dtype, device, temperature = 10000):
309 &quot;&quot;&quot;
310 Sinusoidal position embedding. Returns a flat tensor of shape (h * w, d).
311 &quot;&quot;&quot;
312 assert depth % 4 == 0, &quot;Embedding dimension must be divisible by 4.&quot;
313
314 y, x = torch.meshgrid(torch.arange(height, device=device), torch.arange(width, device=device), indexing=&quot;ij&quot;)
315 omega = torch.arange(depth // 4, device=device) / (depth // 4 - 1)
</pre>
</div>
</div>
</div>
<div id="issue-9">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>329<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
325 class CLIPEmbeddingLayer(nn.Module):
326 def __init__(self, hidden_size: int, num_channels: int, image_size: int, patch_size: int, patch_dropout: float = 0.0, good_dropout: bool = False, dpn: bool = False, sine_positional_embeddings: bool = False):
327 super().__init__()
328
329 assert image_size % patch_size == 0, &quot;Image dimensions must be divisible by the patch size.&quot;
330
331 seq_len = (image_size // patch_size) ** 2
332 self.patch_dropout = patch_dropout
</pre>
</div>
</div>
</div>
<div id="issue-10">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>368<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
364 )
365
366 def forward(self, pixel_values: torch.FloatTensor) -&gt; torch.Tensor:
367 B, C, H, W = pixel_values.shape
368 assert H % self.patch_size == 0, f&quot;Input image height ({H}) needs to be divisible by the patch size ({self.patch_size}).&quot;
369 assert W % self.patch_size == 0, f&quot;Input image width ({W}) needs to be divisible by the patch size ({self.patch_size}).&quot;
370
371 if self.dpn:
</pre>
</div>
</div>
</div>
<div id="issue-11">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>369<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
365
366 def forward(self, pixel_values: torch.FloatTensor) -&gt; torch.Tensor:
367 B, C, H, W = pixel_values.shape
368 assert H % self.patch_size == 0, f&quot;Input image height ({H}) needs to be divisible by the patch size ({self.patch_size}).&quot;
369 assert W % self.patch_size == 0, f&quot;Input image width ({W}) needs to be divisible by the patch size ({self.patch_size}).&quot;
370
371 if self.dpn:
372 patches = self.to_patch_embeddings(pixel_values)
</pre>
</div>
</div>
</div>
<div id="issue-12">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>662<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
658 def forward(self, batch):
659 pixel_values = batch[&#x27;image&#x27;]
660 device = pixel_values.device
661 B, C, H, W = pixel_values.shape
662 assert H % self.patch_size == 0, f&quot;Input image height ({H}) needs to be divisible by the patch size ({self.patch_size}).&quot;
663 assert W % self.patch_size == 0, f&quot;Input image width ({W}) needs to be divisible by the patch size ({self.patch_size}).&quot;
664
665 # Convert image to patches (B, seq_len, C * patch_size * patch_size)
</pre>
</div>
</div>
</div>
<div id="issue-13">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>663<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
659 pixel_values = batch[&#x27;image&#x27;]
660 device = pixel_values.device
661 B, C, H, W = pixel_values.shape
662 assert H % self.patch_size == 0, f&quot;Input image height ({H}) needs to be divisible by the patch size ({self.patch_size}).&quot;
663 assert W % self.patch_size == 0, f&quot;Input image width ({W}) needs to be divisible by the patch size ({self.patch_size}).&quot;
664
665 # Convert image to patches (B, seq_len, C * patch_size * patch_size)
666 patches = self.to_patches(pixel_values)
</pre>
</div>
</div>
</div>
<div id="issue-14">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>841<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
837 super().__init__()
838 self.num_heads = num_heads
839 self.d_model = d_model
840
841 assert d_model % num_heads == 0, &quot;d_model must be divisible by num_heads&quot;
842
843 # MHA
844 self.norm1 = nn.LayerNorm(d_model)
</pre>
</div>
</div>
</div>
<div id="issue-15">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>970<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
966 ):
967 super().__init__(image_size, n_tags)
968
969 #assert image_size % patch_size == 0, &quot;image_size must be divisible by patch_size&quot;
970 assert d_model % num_heads == 0, &quot;d_model must be divisible by num_heads&quot;
971
972 out_dim = n_tags
973 self.n_tags = n_tags
</pre>
</div>
</div>
</div>
<div id="issue-16">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>999<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
995 self.head = nn.Linear(d_model, out_dim)
996
997 def forward(self, batch, return_embeddings=False, return_loss: bool = False, pos_weight = None):
998 B, C, H, W = batch[&#x27;image&#x27;].shape
999 assert H % self.patch_size == 0, f&quot;Input image height ({H}) needs to be divisible by the patch size ({self.patch_size}).&quot;
1000 assert W % self.patch_size == 0, f&quot;Input image width ({W}) needs to be divisible by the patch size ({self.patch_size}).&quot;
1001
1002 x = self.patch_embeddings(batch[&#x27;image&#x27;]) # (bsz, d_model, patch_num, patch_num)
</pre>
</div>
</div>
</div>
<div id="issue-17">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
<b>Line number: </b>1000<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
996
997 def forward(self, batch, return_embeddings=False, return_loss: bool = False, pos_weight = None):
998 B, C, H, W = batch[&#x27;image&#x27;].shape
999 assert H % self.patch_size == 0, f&quot;Input image height ({H}) needs to be divisible by the patch size ({self.patch_size}).&quot;
1000 assert W % self.patch_size == 0, f&quot;Input image width ({W}) needs to be divisible by the patch size ({self.patch_size}).&quot;
1001
1002 x = self.patch_embeddings(batch[&#x27;image&#x27;]) # (bsz, d_model, patch_num, patch_num)
1003 x = x.flatten(2).transpose(1, 2) # (bsz, patch_num ** 2, d_model)
</pre>
</div>
</div>
</div>
<div id="issue-18">
<div class="issue-block issue-sev-low">
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
<b>Test ID:</b> B101<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/moondream/text_model.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/moondream/text_model.py</a><br>
<b>Line number: </b>48<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
<div class="code">
<pre>
44
45 if &quot;&lt;image&gt;&quot; not in prompt:
46 embeds.append(self.text_emb(_tokenize(prompt)))
47 else:
48 assert prompt.count(&quot;&lt;image&gt;&quot;) == 1
49 before, after = prompt.split(&quot;&lt;image&gt;&quot;)
50 embeds.append(self.text_emb(_tokenize(f&quot;{before}&lt;image&gt;&quot;)))
51 embeds.append(image_embeds.to(self.model.device))
</pre>
</div>
</div>
</div>
<div id="issue-19">
<div class="issue-block issue-sev-medium">
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
<b>Test ID:</b> B307<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/suggest.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/suggest.py</a><br>
<b>Line number: </b>599<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
<div class="code">
<pre>
595 if attribute_type == &quot;Category&quot;:
596 categories = categories.split(&quot;,&quot;)
597 setter.add_attribute(attribute_name, Literal, attribute_description, categories)
598 else:
599 attribute_type = eval(attribute_type)
600 setter.add_attribute(attribute_name, attribute_type, attribute_description)
601
602 Analysis = setter.create_model(&quot;Analysis&quot;)
</pre>
</div>
</div>
</div>
</div>
</body>
</html>