mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
Fix Python/JS identifiers that had spaces inserted by the ComfyUI → Hanzo Studio replacement (e.g. class names, variable prefixes). Spaces in identifiers cause syntax errors.
659 lines
26 KiB
HTML
659 lines
26 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">3657</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/__init__.py</a><br>
|
|
<b>Line number: </b>6<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
2 import os
|
|
3 import importlib
|
|
4 import pkg_resources
|
|
5 import sys
|
|
6 import subprocess
|
|
7 import folder_paths
|
|
8
|
|
9 supported_LLava_extensions = set(['.gguf'])
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/__init__.py</a><br>
|
|
<b>Line number: </b>35<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
31
|
|
32 if missing_packages:
|
|
33 print(f"Missing or outdated packages: {', '.join(missing_packages)}")
|
|
34 print("Installing/Updating missing packages...")
|
|
35 subprocess.check_call([sys.executable, '-s', '-m', 'pip', 'install', *missing_packages])
|
|
36 else:
|
|
37 print("All packages from requirements.txt are installed and up to date.")
|
|
38
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
|
|
<b>Line number: </b>7<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
3 import shutil
|
|
4 from os.path import join, dirname, abspath, exists
|
|
5 from os import makedirs, symlink, readlink
|
|
6 import platform
|
|
7 import subprocess
|
|
8 import sys
|
|
9 import importlib.util
|
|
10 import re
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>request_without_timeout: </b> Requests call without timeout<br>
|
|
<b>Test ID:</b> B113<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>LOW<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
|
|
<b>Line number: </b>80<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
76 return system_info
|
|
77
|
|
78 def latest_lamacpp():
|
|
79 try:
|
|
80 response = get("https://api.github.com/repos/abetlen/llama-cpp-python/releases/latest")
|
|
81 return response.json()["tag_name"].replace("v", "")
|
|
82 except Exception:
|
|
83 return "0.2.20"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
|
|
<b>Line number: </b>91<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
87 print(f"Installing {package_name}...")
|
|
88 command = [sys.executable, "-m", "pip", "install", package_name, "--no-cache-dir"]
|
|
89 if custom_command:
|
|
90 command += custom_command.split()
|
|
91 subprocess.check_call(command)
|
|
92 else:
|
|
93 print(f"{package_name} is already installed.")
|
|
94
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
|
|
<b>Line number: </b>144<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
140
|
|
141 # Execute the installation command
|
|
142 try:
|
|
143 print(f"Installing AutoGPTQ with command: {' '.join(base_command)}")
|
|
144 subprocess.check_call(base_command)
|
|
145 except Exception as e:
|
|
146 print(f"Failed to install AutoGPTQ: {e}")
|
|
147
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/install_init.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/install_init.py</a><br>
|
|
<b>Line number: </b>233<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
229 try:
|
|
230 import _winapi
|
|
231 _winapi.CreateJunction(src, dst)
|
|
232 return True
|
|
233 except:
|
|
234 pass
|
|
235 try:
|
|
236 os.symlink(src, dst)
|
|
237 return True
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>177<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
173 self.out_dim = out_dim
|
|
174 self.norm_qk = norm_qk
|
|
175 self.num_heads = num_attention_heads
|
|
176 self.head_dim = hidden_size // num_attention_heads
|
|
177 assert self.head_dim * num_attention_heads == self.embed_dim, "embed_dim must be divisible by num_attention_heads"
|
|
178
|
|
179 self.q_proj = nn.Linear(self.embed_dim, self.embed_dim)
|
|
180 self.kv_proj = nn.Linear(self.embed_dim, self.embed_dim * 2)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>312<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
308 def sinusoidal_position_embedding(width: int, height: int, depth: int, dtype, device, temperature = 10000):
|
|
309 """
|
|
310 Sinusoidal position embedding. Returns a flat tensor of shape (h * w, d).
|
|
311 """
|
|
312 assert depth % 4 == 0, "Embedding dimension must be divisible by 4."
|
|
313
|
|
314 y, x = torch.meshgrid(torch.arange(height, device=device), torch.arange(width, device=device), indexing="ij")
|
|
315 omega = torch.arange(depth // 4, device=device) / (depth // 4 - 1)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>329<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
325 class CLIPEmbeddingLayer(nn.Module):
|
|
326 def __init__(self, hidden_size: int, num_channels: int, image_size: int, patch_size: int, patch_dropout: float = 0.0, good_dropout: bool = False, dpn: bool = False, sine_positional_embeddings: bool = False):
|
|
327 super().__init__()
|
|
328
|
|
329 assert image_size % patch_size == 0, "Image dimensions must be divisible by the patch size."
|
|
330
|
|
331 seq_len = (image_size // patch_size) ** 2
|
|
332 self.patch_dropout = patch_dropout
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-10">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>368<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
364 )
|
|
365
|
|
366 def forward(self, pixel_values: torch.FloatTensor) -> torch.Tensor:
|
|
367 B, C, H, W = pixel_values.shape
|
|
368 assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
|
|
369 assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
|
|
370
|
|
371 if self.dpn:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-11">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>369<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
365
|
|
366 def forward(self, pixel_values: torch.FloatTensor) -> torch.Tensor:
|
|
367 B, C, H, W = pixel_values.shape
|
|
368 assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
|
|
369 assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
|
|
370
|
|
371 if self.dpn:
|
|
372 patches = self.to_patch_embeddings(pixel_values)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-12">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>662<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
658 def forward(self, batch):
|
|
659 pixel_values = batch['image']
|
|
660 device = pixel_values.device
|
|
661 B, C, H, W = pixel_values.shape
|
|
662 assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
|
|
663 assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
|
|
664
|
|
665 # Convert image to patches (B, seq_len, C * patch_size * patch_size)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-13">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>663<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
659 pixel_values = batch['image']
|
|
660 device = pixel_values.device
|
|
661 B, C, H, W = pixel_values.shape
|
|
662 assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
|
|
663 assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
|
|
664
|
|
665 # Convert image to patches (B, seq_len, C * patch_size * patch_size)
|
|
666 patches = self.to_patches(pixel_values)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-14">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>841<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
837 super().__init__()
|
|
838 self.num_heads = num_heads
|
|
839 self.d_model = d_model
|
|
840
|
|
841 assert d_model % num_heads == 0, "d_model must be divisible by num_heads"
|
|
842
|
|
843 # MHA
|
|
844 self.norm1 = nn.LayerNorm(d_model)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-15">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>970<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
966 ):
|
|
967 super().__init__(image_size, n_tags)
|
|
968
|
|
969 #assert image_size % patch_size == 0, "image_size must be divisible by patch_size"
|
|
970 assert d_model % num_heads == 0, "d_model must be divisible by num_heads"
|
|
971
|
|
972 out_dim = n_tags
|
|
973 self.n_tags = n_tags
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-16">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>999<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
995 self.head = nn.Linear(d_model, out_dim)
|
|
996
|
|
997 def forward(self, batch, return_embeddings=False, return_loss: bool = False, pos_weight = None):
|
|
998 B, C, H, W = batch['image'].shape
|
|
999 assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
|
|
1000 assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
|
|
1001
|
|
1002 x = self.patch_embeddings(batch['image']) # (bsz, d_model, patch_num, patch_num)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-17">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/joytagger/Models.py</a><br>
|
|
<b>Line number: </b>1000<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
996
|
|
997 def forward(self, batch, return_embeddings=False, return_loss: bool = False, pos_weight = None):
|
|
998 B, C, H, W = batch['image'].shape
|
|
999 assert H % self.patch_size == 0, f"Input image height ({H}) needs to be divisible by the patch size ({self.patch_size})."
|
|
1000 assert W % self.patch_size == 0, f"Input image width ({W}) needs to be divisible by the patch size ({self.patch_size})."
|
|
1001
|
|
1002 x = self.patch_embeddings(batch['image']) # (bsz, d_model, patch_num, patch_num)
|
|
1003 x = x.flatten(2).transpose(1, 2) # (bsz, patch_num ** 2, d_model)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-18">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/moondream/text_model.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/moondream/text_model.py</a><br>
|
|
<b>Line number: </b>48<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
44
|
|
45 if "<image>" not in prompt:
|
|
46 embeds.append(self.text_emb(_tokenize(prompt)))
|
|
47 else:
|
|
48 assert prompt.count("<image>") == 1
|
|
49 before, after = prompt.split("<image>")
|
|
50 embeds.append(self.text_emb(_tokenize(f"{before}<image>")))
|
|
51 embeds.append(image_embeds.to(self.model.device))
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-19">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
|
|
<b>Test ID:</b> B307<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_VLM_nodes/nodes/suggest.py" target="_blank">/custom_nodes/HanzoStudio_VLM_nodes/nodes/suggest.py</a><br>
|
|
<b>Line number: </b>599<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
595 if attribute_type == "Category":
|
|
596 categories = categories.split(",")
|
|
597 setter.add_attribute(attribute_name, Literal, attribute_description, categories)
|
|
598 else:
|
|
599 attribute_type = eval(attribute_type)
|
|
600 setter.add_attribute(attribute_name, attribute_type, attribute_description)
|
|
601
|
|
602 Analysis = setter.create_model("Analysis")
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|