custom-nodes-security-scan/docs/ComfyUi-Ollama-YN-bandit.html

<!DOCTYPE html>
<html>
<head>

<meta charset="UTF-8">

<title>
    Bandit Report
</title>

<style>

html * {
    font-family: "Arial", sans-serif;
}

pre {
    font-family: "Monaco", monospace;
}

.bordered-box {
    border: 1px solid black;
    padding-top:.5em;
    padding-bottom:.5em;
    padding-left:1em;
}

.metrics-box {
    font-size: 1.1em;
    line-height: 130%;
}

.metrics-title {
    font-size: 1.5em;
    font-weight: 500;
    margin-bottom: .25em;
}

.issue-description {
    font-size: 1.3em;
    font-weight: 500;
}

.candidate-issues {
    margin-left: 2em;
    border-left: solid 1px; LightGray;
    padding-left: 5%;
    margin-top: .2em;
    margin-bottom: .2em;
}

.issue-block {
    border: 1px solid LightGray;
    padding-left: .5em;
    padding-top: .5em;
    padding-bottom: .5em;
    margin-bottom: .5em;
}

.issue-sev-high {
    background-color: Pink;
}

.issue-sev-medium {
    background-color: NavajoWhite;
}

.issue-sev-low {
    background-color: LightCyan;
}

</style>
</head>

<body>

<div id="metrics">
    <div class="metrics-box bordered-box">
        <div class="metrics-title">
            Metrics:<br>
        </div>
        Total lines of code: <span id="loc">462</span><br>
        Total lines skipped (#nosec): <span id="nosec">0</span>
    </div>
</div>




<br>
<div id="results">
    
<div id="issue-0">
<div class="issue-block issue-sev-low">
    <b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
    <b>Test ID:</b> B311<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
    <b>File: </b><a href="/custom_nodes/ComfyUi-Ollama-YN/CompfyuiOllama.py" target="_blank">/custom_nodes/ComfyUi-Ollama-YN/CompfyuiOllama.py</a><br>
    <b>Line number: </b>172<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>

<div class="code">
<pre>
168	        pass
169	
170	    @classmethod
171	    def INPUT_TYPES(s):
172	        seed = random.randint(1, 2 ** 31)
173	        return {
174	            &quot;required&quot;: {
175	                &quot;prompt&quot;: (&quot;STRING&quot;, {
</pre>
</div>


</div>
</div>

<div id="issue-1">
<div class="issue-block issue-sev-low">
    <b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
    <b>Test ID:</b> B311<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
    <b>File: </b><a href="/custom_nodes/ComfyUi-Ollama-YN/CompfyuiOllama.py" target="_blank">/custom_nodes/ComfyUi-Ollama-YN/CompfyuiOllama.py</a><br>
    <b>Line number: </b>288<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>

<div class="code">
<pre>
284	        pass
285	#The default system prompt referenced https://github.com/MinusZoneAI/Hanzo Studio-Prompt-MZ project
286	    @classmethod
287	    def INPUT_TYPES(s):
288	        seed = random.randint(1, 2 ** 31)
289	        return {
290	            &quot;required&quot;: {
291	                &quot;prompt&quot;: (&quot;STRING&quot;, {
</pre>
</div>


</div>
</div>

<div id="issue-2">
<div class="issue-block issue-sev-low">
    <b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
    <b>Test ID:</b> B404<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
    <b>File: </b><a href="/custom_nodes/ComfyUi-Ollama-YN/__init__.py" target="_blank">/custom_nodes/ComfyUi-Ollama-YN/__init__.py</a><br>
    <b>Line number: </b>4<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>

<div class="code">
<pre>
1	from .CompfyuiOllama import NODE_CLASS_MAPPINGS, NODE_DISPLAY_NAME_MAPPINGS
2	import sys
3	import os
4	import subprocess
5	import threading
6	import locale
7	
8	def handle_stream(stream, is_stdout):
</pre>
</div>


</div>
</div>

<div id="issue-3">
<div class="issue-block issue-sev-low">
    <b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
    <b>Test ID:</b> B603<br>
    <b>Severity: </b>LOW<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
    <b>File: </b><a href="/custom_nodes/ComfyUi-Ollama-YN/__init__.py" target="_blank">/custom_nodes/ComfyUi-Ollama-YN/__init__.py</a><br>
    <b>Line number: </b>18<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>

<div class="code">
<pre>
14	        else: 
15	            print(msg, end=&quot;&quot;, file=sys.stderr)
16	
17	def process_wrap(cmd_str, cwd=None):
18	    process = subprocess.Popen(cmd_str, cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1)
19	
20	    stdout_thread = threading.Thread(target=handle_stream, args=(process.stdout, True))
21	    stderr_thread = threading.Thread(target=handle_stream, args=(process.stderr, False))
</pre>
</div>


</div>
</div>

</div>

</body>
</html>