custom-nodes-security-scan/docs/anynode-bandit.html

<!DOCTYPE html>
<html>
<head>

<meta charset="UTF-8">

<title>
    Bandit Report
</title>

<style>

html * {
    font-family: "Arial", sans-serif;
}

pre {
    font-family: "Monaco", monospace;
}

.bordered-box {
    border: 1px solid black;
    padding-top:.5em;
    padding-bottom:.5em;
    padding-left:1em;
}

.metrics-box {
    font-size: 1.1em;
    line-height: 130%;
}

.metrics-title {
    font-size: 1.5em;
    font-weight: 500;
    margin-bottom: .25em;
}

.issue-description {
    font-size: 1.3em;
    font-weight: 500;
}

.candidate-issues {
    margin-left: 2em;
    border-left: solid 1px; LightGray;
    padding-left: 5%;
    margin-top: .2em;
    margin-bottom: .2em;
}

.issue-block {
    border: 1px solid LightGray;
    padding-left: .5em;
    padding-top: .5em;
    padding-bottom: .5em;
    margin-bottom: .5em;
}

.issue-sev-high {
    background-color: Pink;
}

.issue-sev-medium {
    background-color: NavajoWhite;
}

.issue-sev-low {
    background-color: LightCyan;
}

</style>
</head>

<body>

<div id="metrics">
    <div class="metrics-box bordered-box">
        <div class="metrics-title">
            Metrics:<br>
        </div>
        Total lines of code: <span id="loc">1028</span><br>
        Total lines skipped (#nosec): <span id="nosec">0</span>
    </div>
</div>




<br>
<div id="results">
    
<div id="issue-0">
<div class="issue-block issue-sev-medium">
    <b>exec_used: </b> Use of exec detected.<br>
    <b>Test ID:</b> B102<br>
    <b>Severity: </b>MEDIUM<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
    <b>File: </b><a href="/custom_nodes/anynode/nodes/any.py" target="_blank">/custom_nodes/anynode/nodes/any.py</a><br>
    <b>Line number: </b>333<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b102_exec_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b102_exec_used.html</a><br>

<div class="code">
<pre>
329	            except Exception as e:
330	                print(f&quot;Failed to import submodules for {module_name}: {e}&quot;)
331	            
332	        try:
333	            exec(sanitize_code(code_string), globals_dict, locals_dict)
334	        except Exception as e:
335	            print(&quot;An error occurred:&quot;)
336	            traceback.print_exc()
</pre>
</div>


</div>
</div>

<div id="issue-1">
<div class="issue-block issue-sev-high">
    <b>hashlib: </b> Use of weak MD5 hash for security. Consider usedforsecurity=False<br>
    <b>Test ID:</b> B324<br>
    <b>Severity: </b>HIGH<br>
    <b>Confidence: </b>HIGH<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/327.html" target="_blank">CWE-327</a><br>
    <b>File: </b><a href="/custom_nodes/anynode/nodes/util_functions.py" target="_blank">/custom_nodes/anynode/nodes/util_functions.py</a><br>
    <b>Line number: </b>45<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b324_hashlib.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b324_hashlib.html</a><br>

<div class="code">
<pre>
41	        with open(self.registry_file, &quot;w&quot;) as f:
42	            json.dump(self.registry, f, indent=4)
43	
44	    def hash_prompt(self, prompt):
45	        return hashlib.md5(prompt.encode(&#x27;utf-8&#x27;)).hexdigest()
46	
47	    def add_function(self, prompt, function_code, imports, comment, input_types):
48	        prompt_hash = self.hash_prompt(prompt)
</pre>
</div>


</div>
</div>

<div id="issue-2">
<div class="issue-block issue-sev-medium">
    <b>request_without_timeout: </b> Requests call without timeout<br>
    <b>Test ID:</b> B113<br>
    <b>Severity: </b>MEDIUM<br>
    <b>Confidence: </b>LOW<br>
    <b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
    <b>File: </b><a href="/custom_nodes/anynode/nodes/util_oai_compatible.py" target="_blank">/custom_nodes/anynode/nodes/util_oai_compatible.py</a><br>
    <b>Line number: </b>26<br>
    <b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>

<div class="code">
<pre>
22	                         {&quot;role&quot;: &quot;user&quot;, &quot;content&quot;: prompt}],
23	            &quot;temperature&quot;: temperature,
24	            &quot;max_tokens&quot;: max_tokens
25	        }
26	        response = requests.post(self.api_url, headers=headers, json=payload)
27	        if response.status_code == 200:
28	            return response.json().get(&#x27;choices&#x27;, [{}])[0].get(&#x27;message&#x27;, {}).get(&#x27;content&#x27;, &#x27;&#x27;).strip()
29	        else:
</pre>
</div>


</div>
</div>

</div>

</body>
</html>