mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
610 lines
21 KiB
HTML
610 lines
21 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">1934</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>exec_used: </b> Use of exec detected.<br>
|
|
<b>Test ID:</b> B102<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/EVAL.py" target="_blank">/custom_nodes/NodeGPT/EVAL.py</a><br>
|
|
<b>Line number: </b>35<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b102_exec_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b102_exec_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
31
|
|
32 def EVAL(self, Python, a_bool=None, b_bool=None, a_int=None, b_int=None, a_float=None, b_float=None, a_string=None,
|
|
33 b_string=None, c_string=None):
|
|
34
|
|
35 exec(Python)
|
|
36
|
|
37 return (c_bool, c_int, c_float, d_string, c_Number,)
|
|
38
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>request_without_timeout: </b> Requests call without timeout<br>
|
|
<b>Test ID:</b> B113<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>LOW<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/Old/Textnode.py" target="_blank">/custom_nodes/NodeGPT/Old/Textnode.py</a><br>
|
|
<b>Line number: </b>179<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
175 'early_stopping': self.early_stopping,
|
|
176 'seed': self.seed,
|
|
177 }
|
|
178 payload = json.dumps([self.prompt, params])
|
|
179 response = requests.post(url, headers=headers, json={
|
|
180 "data": [
|
|
181 payload
|
|
182 ]
|
|
183 })
|
|
184
|
|
185 # Check for errors in API response
|
|
186 if response.status_code != 200:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>request_without_timeout: </b> Requests call without timeout<br>
|
|
<b>Test ID:</b> B113<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>LOW<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/Old/Textnode.py" target="_blank">/custom_nodes/NodeGPT/Old/Textnode.py</a><br>
|
|
<b>Line number: </b>414<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
410
|
|
411
|
|
412 payload = json.dumps([prompt, params])
|
|
413
|
|
414 response = requests.post(f"http://{server}:7860/run/textgen", json={
|
|
415 "data": [
|
|
416 payload
|
|
417 ]
|
|
418 }).json()
|
|
419
|
|
420 response_data = response["data"]
|
|
421
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>3<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import importlib
|
|
2 import os
|
|
3 import subprocess
|
|
4 import json
|
|
5
|
|
6
|
|
7 base_dir = os.path.dirname(os.path.abspath(__file__))
|
|
8
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>27<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
23 # Navigate to the NodeGPT directory
|
|
24 os.chdir(base_dir)
|
|
25
|
|
26 # Run the install.bat file
|
|
27 subprocess.run('install.bat', shell=True)
|
|
28
|
|
29 venv_activate = ".\\venv\\Scripts\\activate"
|
|
30 requirements_install = "pip install -r requirements.txt"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell<br>
|
|
<b>Test ID:</b> B602<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>27<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
23 # Navigate to the NodeGPT directory
|
|
24 os.chdir(base_dir)
|
|
25
|
|
26 # Run the install.bat file
|
|
27 subprocess.run('install.bat', shell=True)
|
|
28
|
|
29 venv_activate = ".\\venv\\Scripts\\activate"
|
|
30 requirements_install = "pip install -r requirements.txt"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-high">
|
|
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True identified, security issue.<br>
|
|
<b>Test ID:</b> B602<br>
|
|
<b>Severity: </b>HIGH<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>32<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
28
|
|
29 venv_activate = ".\\venv\\Scripts\\activate"
|
|
30 requirements_install = "pip install -r requirements.txt"
|
|
31
|
|
32 subprocess.run(f"{venv_activate} && {requirements_install}", shell=True, stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT)
|
|
33
|
|
34 def install_package2():
|
|
35 # Navigate to the NodeGPT directory
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>39<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
35 # Navigate to the NodeGPT directory
|
|
36 os.chdir(base_dir)
|
|
37
|
|
38 # Run the install.bat file
|
|
39 subprocess.run('install.bat', shell=True)
|
|
40
|
|
41 venv_activate = ".\\venv\\Scripts\\activate"
|
|
42 requirements_install = "pip install -r requirements.txt"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell<br>
|
|
<b>Test ID:</b> B602<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>39<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
35 # Navigate to the NodeGPT directory
|
|
36 os.chdir(base_dir)
|
|
37
|
|
38 # Run the install.bat file
|
|
39 subprocess.run('install.bat', shell=True)
|
|
40
|
|
41 venv_activate = ".\\venv\\Scripts\\activate"
|
|
42 requirements_install = "pip install -r requirements.txt"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-high">
|
|
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True identified, security issue.<br>
|
|
<b>Test ID:</b> B602<br>
|
|
<b>Severity: </b>HIGH<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>44<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
40
|
|
41 venv_activate = ".\\venv\\Scripts\\activate"
|
|
42 requirements_install = "pip install -r requirements.txt"
|
|
43
|
|
44 subprocess.run(f"{venv_activate} && {requirements_install}", shell=True)
|
|
45
|
|
46 def read_config(file_path):
|
|
47 with open(file_path, 'r') as file:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-10">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>56<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
52 # Navigate to the repository directory
|
|
53 os.chdir(repo_path)
|
|
54
|
|
55 # Execute 'git pull' command
|
|
56 result = subprocess.run(['git', 'pull'], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
57 print(result.stdout.decode())
|
|
58
|
|
59 except Exception as e:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-11">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/__init__.py" target="_blank">/custom_nodes/NodeGPT/__init__.py</a><br>
|
|
<b>Line number: </b>56<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
52 # Navigate to the repository directory
|
|
53 os.chdir(repo_path)
|
|
54
|
|
55 # Execute 'git pull' command
|
|
56 result = subprocess.run(['git', 'pull'], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
57 print(result.stdout.decode())
|
|
58
|
|
59 except Exception as e:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-12">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
|
|
<b>Line number: </b>3<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 import importlib
|
|
2 import os
|
|
3 import subprocess
|
|
4
|
|
5 base_dir = os.path.dirname(os.path.abspath(__file__))
|
|
6
|
|
7 def install_package():
|
|
8 # Navigate to the NodeGPT directory
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-13">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
|
|
<b>Line number: </b>12<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
8 # Navigate to the NodeGPT directory
|
|
9 os.chdir(base_dir)
|
|
10
|
|
11 # Run the install.bat file
|
|
12 subprocess.run('install.bat', shell=True)
|
|
13
|
|
14 venv_activate = ".\\venv\\Scripts\\activate"
|
|
15 requirements_install = "pip install -r requirements.txt"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-14">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell<br>
|
|
<b>Test ID:</b> B602<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
|
|
<b>Line number: </b>12<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
8 # Navigate to the NodeGPT directory
|
|
9 os.chdir(base_dir)
|
|
10
|
|
11 # Run the install.bat file
|
|
12 subprocess.run('install.bat', shell=True)
|
|
13
|
|
14 venv_activate = ".\\venv\\Scripts\\activate"
|
|
15 requirements_install = "pip install -r requirements.txt"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-15">
|
|
<div class="issue-block issue-sev-high">
|
|
<b>subprocess_popen_with_shell_equals_true: </b> subprocess call with shell=True identified, security issue.<br>
|
|
<b>Test ID:</b> B602<br>
|
|
<b>Severity: </b>HIGH<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
|
|
<b>Line number: </b>17<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b602_subprocess_popen_with_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
13
|
|
14 venv_activate = ".\\venv\\Scripts\\activate"
|
|
15 requirements_install = "pip install -r requirements.txt"
|
|
16
|
|
17 subprocess.run(f"{venv_activate} && {requirements_install}", shell=True)#, stdout=subprocess.DEVNULL, stderr=subprocess.STDOUT)
|
|
18
|
|
19 def update_repository(repo_path):
|
|
20 try:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-16">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
|
|
<b>Line number: </b>25<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
21 # Navigate to the repository directory
|
|
22 os.chdir(repo_path)
|
|
23
|
|
24 # Execute 'git pull' command
|
|
25 result = subprocess.run(['git', 'pull'], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
26 print(result.stdout.decode())
|
|
27
|
|
28 except Exception as e:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-17">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/NodeGPT/update.py" target="_blank">/custom_nodes/NodeGPT/update.py</a><br>
|
|
<b>Line number: </b>25<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
21 # Navigate to the repository directory
|
|
22 os.chdir(repo_path)
|
|
23
|
|
24 # Execute 'git pull' command
|
|
25 result = subprocess.run(['git', 'pull'], check=True)#, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
|
|
26 print(result.stdout.decode())
|
|
27
|
|
28 except Exception as e:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|