mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
zeekay
84ca3e48e7
Fix Python/JS identifiers that had spaces inserted by the ComfyUI → Hanzo Studio replacement (e.g. class names, variable prefixes). Spaces in identifiers cause syntax errors.
465 lines
17 KiB
HTML
465 lines
17 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">5247</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py</a><br>
|
|
<b>Line number: </b>5<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 from .ttNpy.tinyterraNodes import TTN_VERSIONS
|
|
2 from .ttNpy import ttNserver # Do Not Remove
|
|
3 import configparser
|
|
4 import folder_paths
|
|
5 import subprocess
|
|
6 import shutil
|
|
7 import os
|
|
8
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py</a><br>
|
|
<b>Line number: </b>115<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
111
|
|
112 # Autoupdate if True
|
|
113 if config_value_validator("ttNodes", "auto_update", 'false') == 'true':
|
|
114 try:
|
|
115 with subprocess.Popen(["git", "pull"], cwd=cwd_path, stdout=subprocess.PIPE) as p:
|
|
116 p.wait()
|
|
117 result = p.communicate()[0].decode()
|
|
118 if result != "Already up to date.\n":
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py</a><br>
|
|
<b>Line number: </b>115<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
111
|
|
112 # Autoupdate if True
|
|
113 if config_value_validator("ttNodes", "auto_update", 'false') == 'true':
|
|
114 try:
|
|
115 with subprocess.Popen(["git", "pull"], cwd=cwd_path, stdout=subprocess.PIPE) as p:
|
|
116 p.wait()
|
|
117 result = p.communicate()[0].decode()
|
|
118 if result != "Already up to date.\n":
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/__init__.py</a><br>
|
|
<b>Line number: </b>120<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
116 p.wait()
|
|
117 result = p.communicate()[0].decode()
|
|
118 if result != "Already up to date.\n":
|
|
119 print("\033[92m[t ttNodes Updated t]\033[0m")
|
|
120 except:
|
|
121 pass
|
|
122
|
|
123 # --------- WEB ---------- #
|
|
124 # Remove old web JS folder
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
|
|
<b>Test ID:</b> B310<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/tinyterraNodes.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/tinyterraNodes.py</a><br>
|
|
<b>Line number: </b>78<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
74 # Fetch the NSP Pantry
|
|
75 if pantry_path is None:
|
|
76 pantry_path = os.path.join(ttNpaths.tinyterraNodes, 'nsp_pantry.json')
|
|
77 if not os.path.exists(pantry_path):
|
|
78 response = urlopen('https://raw.githubusercontent.com/WASasquatch/noodle-soup-prompts/main/nsp_pantry.json')
|
|
79 tmp_pantry = json.loads(response.read())
|
|
80 # Dump JSON locally
|
|
81 pantry_serialized = json.dumps(tmp_pantry, indent=4)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/tinyterraNodes.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/tinyterraNodes.py</a><br>
|
|
<b>Line number: </b>107<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
103
|
|
104 # Apply random results for each noodle counted
|
|
105 for _ in range(tcount):
|
|
106 new_text = new_text.replace(
|
|
107 tkey, random.choice(nspterminology[term]), 1)
|
|
108 seed += 1
|
|
109 random.seed(seed)
|
|
110
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/tinyterraNodes.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/tinyterraNodes.py</a><br>
|
|
<b>Line number: </b>548<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
544 font = None
|
|
545 if os.path.exists(ttNpaths.font_path):
|
|
546 try:
|
|
547 font = ImageFont.truetype(str(Path(ttNpaths.font_path)), font_size)
|
|
548 except:
|
|
549 pass
|
|
550
|
|
551 if font is None:
|
|
552 font = ImageFont.load_default(font_size)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
|
|
<b>Test ID:</b> B310<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNlegacyNodes.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNlegacyNodes.py</a><br>
|
|
<b>Line number: </b>40<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
36 # Fetch the NSP Pantry
|
|
37 if pantry_path is None:
|
|
38 pantry_path = os.path.join(ttNpaths.tinyterraNodes, 'nsp_pantry.json')
|
|
39 if not os.path.exists(pantry_path):
|
|
40 response = urlopen('https://raw.githubusercontent.com/WASasquatch/noodle-soup-prompts/main/nsp_pantry.json')
|
|
41 tmp_pantry = json.loads(response.read())
|
|
42 # Dump JSON locally
|
|
43 pantry_serialized = json.dumps(tmp_pantry, indent=4)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNlegacyNodes.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNlegacyNodes.py</a><br>
|
|
<b>Line number: </b>69<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
65
|
|
66 # Apply random results for each noodle counted
|
|
67 for _ in range(tcount):
|
|
68 new_text = new_text.replace(
|
|
69 tkey, random.choice(nspterminology[term]), 1)
|
|
70 seed += 1
|
|
71 random.seed(seed)
|
|
72
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNlegacyNodes.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNlegacyNodes.py</a><br>
|
|
<b>Line number: </b>732<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
728 plot_image_vars["seed"] = seed - index
|
|
729 value_label = f"{plot_image_vars['seed']}"
|
|
730
|
|
731 elif value == 'randomize':
|
|
732 plot_image_vars["seed"] = random.randint(0, 0xffffffffffffffff)
|
|
733 value_label = f"{plot_image_vars['seed']}"
|
|
734 else:
|
|
735 plot_image_vars[value_type] = value
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-10">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>try_except_pass: </b> Try, Except, Pass detected.<br>
|
|
<b>Test ID:</b> B110<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNserver.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNserver.py</a><br>
|
|
<b>Line number: </b>15<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b110_try_except_pass.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
11 @routes.get("/ttN/reboot")
|
|
12 def restart(self):
|
|
13 try:
|
|
14 sys.stdout.close_log()
|
|
15 except Exception as e:
|
|
16 pass
|
|
17
|
|
18 print(f"\nRestarting...\n\n")
|
|
19 if sys.platform.startswith('win32'):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-11">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_no_shell: </b> Starting a process without a shell.<br>
|
|
<b>Test ID:</b> B606<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNserver.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNserver.py</a><br>
|
|
<b>Line number: </b>20<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
16 pass
|
|
17
|
|
18 print(f"\nRestarting...\n\n")
|
|
19 if sys.platform.startswith('win32'):
|
|
20 return os.execv(sys.executable, ['"' + sys.executable + '"', '"' + sys.argv[0] + '"'] + sys.argv[1:])
|
|
21 else:
|
|
22 return os.execv(sys.executable, [sys.executable] + sys.argv)
|
|
23
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-12">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_no_shell: </b> Starting a process without a shell.<br>
|
|
<b>Test ID:</b> B606<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNserver.py" target="_blank">/custom_nodes/HanzoStudio_tinyterraNodes/ttNpy/ttNserver.py</a><br>
|
|
<b>Line number: </b>22<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b606_start_process_with_no_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
18 print(f"\nRestarting...\n\n")
|
|
19 if sys.platform.startswith('win32'):
|
|
20 return os.execv(sys.executable, ['"' + sys.executable + '"', '"' + sys.argv[0] + '"'] + sys.argv[1:])
|
|
21 else:
|
|
22 return os.execv(sys.executable, [sys.executable] + sys.argv)
|
|
23
|
|
24 @routes.get("/ttN/models")
|
|
25 def get_models(self):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|