Files

610 lines
21 KiB
HTML

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>
Bandit Report
</title>
<style>
html * {
font-family: "Arial", sans-serif;
}
pre {
font-family: "Monaco", monospace;
}
.bordered-box {
border: 1px solid black;
padding-top:.5em;
padding-bottom:.5em;
padding-left:1em;
}
.metrics-box {
font-size: 1.1em;
line-height: 130%;
}
.metrics-title {
font-size: 1.5em;
font-weight: 500;
margin-bottom: .25em;
}
.issue-description {
font-size: 1.3em;
font-weight: 500;
}
.candidate-issues {
margin-left: 2em;
border-left: solid 1px; LightGray;
padding-left: 5%;
margin-top: .2em;
margin-bottom: .2em;
}
.issue-block {
border: 1px solid LightGray;
padding-left: .5em;
padding-top: .5em;
padding-bottom: .5em;
margin-bottom: .5em;
}
.issue-sev-high {
background-color: Pink;
}
.issue-sev-medium {
background-color: NavajoWhite;
}
.issue-sev-low {
background-color: LightCyan;
}
</style>
</head>
<body>
<div id="metrics">
<div class="metrics-box bordered-box">
<div class="metrics-title">
Metrics:<br>
</div>
Total lines of code: <span id="loc">1934</span><br>
Total lines skipped (#nosec): <span id="nosec">0</span>
</div>
</div>
<br>
<div id="results">
<div id="issue-0">
<div class="issue-block issue-sev-medium">
<b>exec_used: </b> Use of exec detected.<br>
<b>Test ID:</b> B102<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/EVAL.py" target="_blank">/custom_nodes/NodeGPT/EVAL.py</a><br>
<b>Line number: </b>35<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b102_exec_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b102_exec_used.html</a><br>
<div class="code">
<pre>
31
32 def EVAL(self, Python, a_bool=None, b_bool=None, a_int=None, b_int=None, a_float=None, b_float=None, a_string=None,
33 b_string=None, c_string=None):
34
35 exec(Python)
36
37 return (c_bool, c_int, c_float, d_string, c_Number,)
38
</pre>
</div>
</div>
</div>
<div id="issue-1">
<div class="issue-block issue-sev-medium">
<b>request_without_timeout: </b> Requests call without timeout<br>
<b>Test ID:</b> B113<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>LOW<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/Old/Textnode.py" target="_blank">/custom_nodes/NodeGPT/Old/Textnode.py</a><br>
<b>Line number: </b>179<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
<div class="code">
<pre>
175 &#x27;early_stopping&#x27;: self.early_stopping,
176 &#x27;seed&#x27;: self.seed,
177 }
178 payload = json.dumps([self.prompt, params])
179 response = requests.post(url, headers=headers, json={
180 &quot;data&quot;: [
181 payload
182 ]
183 })
184
185 # Check for errors in API response
186 if response.status_code != 200:
</pre>
</div>
</div>
</div>
<div id="issue-2">
<div class="issue-block issue-sev-medium">
<b>request_without_timeout: </b> Requests call without timeout<br>
<b>Test ID:</b> B113<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>LOW<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/Old/Textnode.py" target="_blank">/custom_nodes/NodeGPT/Old/Textnode.py</a><br>
<b>Line number: </b>414<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
<div class="code">
<pre>
410
411
412 payload = json.dumps([prompt, params])
413
414 response = requests.post(f&quot;http://{server}:7860/run/textgen&quot;, json={
415 &quot;data&quot;: [
416 payload
417 ]
418 }).json()
419
420 response_data = response[&quot;data&quot;]
421
</pre>
</div>
</div>
</div>
<div id="issue-3">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>3<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1 import importlib
2 import os
3 import subprocess
4 import json
5
6
7 base_dir = os.path.dirname(os.path.abspath(__file__))
8
</pre>
</div>
</div>
</div>
<div id="issue-4">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>27<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
23 # Navigate to the NodeGPT directory
24 os.chdir(base_dir)
25
26 # Run the install.bat file
27 subprocess.run(&#x27;install.bat&#x27;, shell=True)
28
29 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
30 requirements_install = &quot;pip install -r requirements.txt&quot;
</pre>
</div>
</div>
</div>
<div id="issue-5">
<div class="issue-block issue-sev-low">
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell<br>
<b>Test ID:</b> B602<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>27<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
<div class="code">
<pre>
23 # Navigate to the NodeGPT directory
24 os.chdir(base_dir)
25
26 # Run the install.bat file
27 subprocess.run(&#x27;install.bat&#x27;, shell=True)
28
29 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
30 requirements_install = &quot;pip install -r requirements.txt&quot;
</pre>
</div>
</div>
</div>
<div id="issue-6">
<div class="issue-block issue-sev-high">
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True identified, security issue.<br>
<b>Test ID:</b> B602<br>
<b>Severity: </b>HIGH<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>32<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
<div class="code">
<pre>
28
29 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
30 requirements_install = &quot;pip install -r requirements.txt&quot;
31
32 subprocess.run(f&quot;{venv_activate} &amp;&amp; {requirements_install}&quot;, shell=True, stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT)
33
34 def install_package2():
35 # Navigate to the NodeGPT directory
</pre>
</div>
</div>
</div>
<div id="issue-7">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>39<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
35 # Navigate to the NodeGPT directory
36 os.chdir(base_dir)
37
38 # Run the install.bat file
39 subprocess.run(&#x27;install.bat&#x27;, shell=True)
40
41 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
42 requirements_install = &quot;pip install -r requirements.txt&quot;
</pre>
</div>
</div>
</div>
<div id="issue-8">
<div class="issue-block issue-sev-low">
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell<br>
<b>Test ID:</b> B602<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>39<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
<div class="code">
<pre>
35 # Navigate to the NodeGPT directory
36 os.chdir(base_dir)
37
38 # Run the install.bat file
39 subprocess.run(&#x27;install.bat&#x27;, shell=True)
40
41 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
42 requirements_install = &quot;pip install -r requirements.txt&quot;
</pre>
</div>
</div>
</div>
<div id="issue-9">
<div class="issue-block issue-sev-high">
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True identified, security issue.<br>
<b>Test ID:</b> B602<br>
<b>Severity: </b>HIGH<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>44<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
<div class="code">
<pre>
40
41 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
42 requirements_install = &quot;pip install -r requirements.txt&quot;
43
44 subprocess.run(f&quot;{venv_activate} &amp;&amp; {requirements_install}&quot;, shell=True)
45
46 def read_config(file_path):
47 with open(file_path, &#x27;r&#x27;) as file:
</pre>
</div>
</div>
</div>
<div id="issue-10">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>56<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
52 # Navigate to the repository directory
53 os.chdir(repo_path)
54
55 # Execute &#x27;git pull&#x27; command
56 result = subprocess.run([&#x27;git&#x27;, &#x27;pull&#x27;], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
57 print(result.stdout.decode())
58
59 except Exception as e:
</pre>
</div>
</div>
</div>
<div id="issue-11">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
<b>Line number: </b>56<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
52 # Navigate to the repository directory
53 os.chdir(repo_path)
54
55 # Execute &#x27;git pull&#x27; command
56 result = subprocess.run([&#x27;git&#x27;, &#x27;pull&#x27;], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
57 print(result.stdout.decode())
58
59 except Exception as e:
</pre>
</div>
</div>
</div>
<div id="issue-12">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
<b>Test ID:</b> B404<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
<b>Line number: </b>3<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
<div class="code">
<pre>
1 import importlib
2 import os
3 import subprocess
4
5 base_dir = os.path.dirname(os.path.abspath(__file__))
6
7 def install_package():
8 # Navigate to the NodeGPT directory
</pre>
</div>
</div>
</div>
<div id="issue-13">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
<b>Line number: </b>12<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
8 # Navigate to the NodeGPT directory
9 os.chdir(base_dir)
10
11 # Run the install.bat file
12 subprocess.run(&#x27;install.bat&#x27;, shell=True)
13
14 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
15 requirements_install = &quot;pip install -r requirements.txt&quot;
</pre>
</div>
</div>
</div>
<div id="issue-14">
<div class="issue-block issue-sev-low">
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell<br>
<b>Test ID:</b> B602<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
<b>Line number: </b>12<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
<div class="code">
<pre>
8 # Navigate to the NodeGPT directory
9 os.chdir(base_dir)
10
11 # Run the install.bat file
12 subprocess.run(&#x27;install.bat&#x27;, shell=True)
13
14 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
15 requirements_install = &quot;pip install -r requirements.txt&quot;
</pre>
</div>
</div>
</div>
<div id="issue-15">
<div class="issue-block issue-sev-high">
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True identified, security issue.<br>
<b>Test ID:</b> B602<br>
<b>Severity: </b>HIGH<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
<b>Line number: </b>17<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
<div class="code">
<pre>
13
14 venv_activate = &quot;.\\venv\\Scripts\\activate&quot;
15 requirements_install = &quot;pip install -r requirements.txt&quot;
16
17 subprocess.run(f&quot;{venv_activate} &amp;&amp; {requirements_install}&quot;, shell=True)#, stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT)
18
19 def update_repository(repo_path):
20 try:
</pre>
</div>
</div>
</div>
<div id="issue-16">
<div class="issue-block issue-sev-low">
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
<b>Test ID:</b> B607<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
<b>Line number: </b>25<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
<div class="code">
<pre>
21 # Navigate to the repository directory
22 os.chdir(repo_path)
23
24 # Execute &#x27;git pull&#x27; command
25 result = subprocess.run([&#x27;git&#x27;, &#x27;pull&#x27;], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
26 print(result.stdout.decode())
27
28 except Exception as e:
</pre>
</div>
</div>
</div>
<div id="issue-17">
<div class="issue-block issue-sev-low">
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
<b>Test ID:</b> B603<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
<b>Line number: </b>25<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
<div class="code">
<pre>
21 # Navigate to the repository directory
22 os.chdir(repo_path)
23
24 # Execute &#x27;git pull&#x27; command
25 result = subprocess.run([&#x27;git&#x27;, &#x27;pull&#x27;], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
26 print(result.stdout.decode())
27
28 except Exception as e:
</pre>
</div>
</div>
</div>
</div>
</body>
</html>