mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
322 lines
11 KiB
HTML
322 lines
11 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">1875</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/lib/actions/scale_dims.py" target="_blank">/custom_nodes/KepPromptLang/lib/actions/scale_dims.py</a><br>
|
|
<b>Line number: </b>40<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
36
|
|
37 if len(arg) != 1:
|
|
38 raise ValueError("ScaleDims scale args must be in the format of <dim>,<scale>(e.g. 4,1.5) but got multiple segments")
|
|
39 extracted_arg = arg[0]
|
|
40 assert isinstance(extracted_arg, PromptSegment)
|
|
41
|
|
42 if "," not in extracted_arg.text:
|
|
43 raise ValueError("ScaleDims scale args must be in the format of <dim>,<scale>(e.g. 4,1.5) but got a segment with no comma: " + extracted_arg.text)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/lib/actions/set_dims.py" target="_blank">/custom_nodes/KepPromptLang/lib/actions/set_dims.py</a><br>
|
|
<b>Line number: </b>40<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
36
|
|
37 if len(arg) != 1:
|
|
38 raise ValueError("SetDims value args must be in the format of <dim>,<value>(e.g. 4,1.5) but got multiple segments")
|
|
39 extracted_arg = arg[0]
|
|
40 assert isinstance(extracted_arg, PromptSegment)
|
|
41
|
|
42 if "," not in extracted_arg.text:
|
|
43 raise ValueError("SetDims value args must be in the format of <dim>,<value>(e.g. 4,1.5) but got a segment with no comma: " + extracted_arg.text)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/lib/clip_model.py" target="_blank">/custom_nodes/KepPromptLang/lib/clip_model.py</a><br>
|
|
<b>Line number: </b>31<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
27 def __init__(self, version="openai/clip-vit-large-patch14", device="cpu", max_length=77,
|
|
28 freeze=True, layer="last", layer_idx=None, textmodel_json_config=None,
|
|
29 textmodel_path=None, dtype=None): # clip-vit-base-patch32
|
|
30 super().__init__()
|
|
31 assert layer in self.LAYERS
|
|
32 self.num_layers = 12
|
|
33 if textmodel_path is not None:
|
|
34 # Our transformer
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/lib/clip_model.py" target="_blank">/custom_nodes/KepPromptLang/lib/clip_model.py</a><br>
|
|
<b>Line number: </b>62<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
58 self.logit_scale = torch.nn.Parameter(torch.tensor(4.6055))
|
|
59
|
|
60 self.layer_norm_hidden_state = True
|
|
61 if layer == "hidden":
|
|
62 assert layer_idx is not None
|
|
63 assert abs(layer_idx) <= self.num_layers
|
|
64 self.clip_layer(layer_idx)
|
|
65 self.layer_default = (self.layer, self.layer_idx)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/lib/clip_model.py" target="_blank">/custom_nodes/KepPromptLang/lib/clip_model.py</a><br>
|
|
<b>Line number: </b>63<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
59
|
|
60 self.layer_norm_hidden_state = True
|
|
61 if layer == "hidden":
|
|
62 assert layer_idx is not None
|
|
63 assert abs(layer_idx) <= self.num_layers
|
|
64 self.clip_layer(layer_idx)
|
|
65 self.layer_default = (self.layer, self.layer_idx)
|
|
66
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
|
|
<b>Test ID:</b> B310<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/test_files/run_workflow.py" target="_blank">/custom_nodes/KepPromptLang/test_files/run_workflow.py</a><br>
|
|
<b>Line number: </b>20<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
16 data = json.dumps(p).encode('utf-8')
|
|
17 req = urllib.request.Request("http://{}/prompt".format(server_address), data=data)
|
|
18
|
|
19 try:
|
|
20 response = urllib.request.urlopen(req)
|
|
21 return json.loads(response.read())
|
|
22 except urllib.error.HTTPError as e:
|
|
23 print(f"HTTP Error {e.code}: {e.reason}")
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
|
|
<b>Test ID:</b> B310<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/test_files/run_workflow.py" target="_blank">/custom_nodes/KepPromptLang/test_files/run_workflow.py</a><br>
|
|
<b>Line number: </b>41<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
37
|
|
38 def get_image(filename, subfolder, folder_type):
|
|
39 data = {"filename": filename, "subfolder": subfolder, "type": folder_type}
|
|
40 url_values = urllib.parse.urlencode(data)
|
|
41 with urllib.request.urlopen("http://{}/view?{}".format(server_address, url_values)) as response:
|
|
42 return response.read()
|
|
43
|
|
44 def get_history(prompt_id):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.<br>
|
|
<b>Test ID:</b> B310<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/22.html" target="_blank">CWE-22</a><br>
|
|
<b>File: </b><a href="/custom_nodes/KepPromptLang/test_files/run_workflow.py" target="_blank">/custom_nodes/KepPromptLang/test_files/run_workflow.py</a><br>
|
|
<b>Line number: </b>45<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b310-urllib-urlopen</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
41 with urllib.request.urlopen("http://{}/view?{}".format(server_address, url_values)) as response:
|
|
42 return response.read()
|
|
43
|
|
44 def get_history(prompt_id):
|
|
45 with urllib.request.urlopen("http://{}/history/{}".format(server_address, prompt_id)) as response:
|
|
46 return json.loads(response.read())
|
|
47
|
|
48 def get_images(ws, prompt):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|