mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
322 lines
11 KiB
HTML
322 lines
11 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">220</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_a_shell: </b> Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell<br>
|
|
<b>Test ID:</b> B605<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>30<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
26 print("BilboX:",type)
|
|
27 json_obj = {"server_op": type}
|
|
28
|
|
29 if(type == "shutdown"):
|
|
30 os.system("shutdown /s") # Shutdown
|
|
31 if(type == "reboot"):
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>30<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
26 print("BilboX:",type)
|
|
27 json_obj = {"server_op": type}
|
|
28
|
|
29 if(type == "shutdown"):
|
|
30 os.system("shutdown /s") # Shutdown
|
|
31 if(type == "reboot"):
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_a_shell: </b> Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell<br>
|
|
<b>Test ID:</b> B605<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>32<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
28
|
|
29 if(type == "shutdown"):
|
|
30 os.system("shutdown /s") # Shutdown
|
|
31 if(type == "reboot"):
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
34 os.system("shutdown /l") # logout
|
|
35 if(type == "lock"):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>32<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
28
|
|
29 if(type == "shutdown"):
|
|
30 os.system("shutdown /s") # Shutdown
|
|
31 if(type == "reboot"):
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
34 os.system("shutdown /l") # logout
|
|
35 if(type == "lock"):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_a_shell: </b> Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell<br>
|
|
<b>Test ID:</b> B605<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>34<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
30 os.system("shutdown /s") # Shutdown
|
|
31 if(type == "reboot"):
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
34 os.system("shutdown /l") # logout
|
|
35 if(type == "lock"):
|
|
36 os.system("rundll32.exe user32.dll,LockWorkStation") # logout
|
|
37 return web.json_response(json_obj, content_type='application/json')
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>34<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
30 os.system("shutdown /s") # Shutdown
|
|
31 if(type == "reboot"):
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
34 os.system("shutdown /l") # logout
|
|
35 if(type == "lock"):
|
|
36 os.system("rundll32.exe user32.dll,LockWorkStation") # logout
|
|
37 return web.json_response(json_obj, content_type='application/json')
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_a_shell: </b> Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell<br>
|
|
<b>Test ID:</b> B605<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>36<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
34 os.system("shutdown /l") # logout
|
|
35 if(type == "lock"):
|
|
36 os.system("rundll32.exe user32.dll,LockWorkStation") # logout
|
|
37 return web.json_response(json_obj, content_type='application/json')
|
|
38
|
|
39 WEB_DIRECTORY = "./web"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/bilbox-comfyui/__init__.py" target="_blank">/custom_nodes/bilbox-comfyui/__init__.py</a><br>
|
|
<b>Line number: </b>36<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
32 os.system("shutdown /r") # Restart
|
|
33 if(type == "logout"):
|
|
34 os.system("shutdown /l") # logout
|
|
35 if(type == "lock"):
|
|
36 os.system("rundll32.exe user32.dll,LockWorkStation") # logout
|
|
37 return web.json_response(json_obj, content_type='application/json')
|
|
38
|
|
39 WEB_DIRECTORY = "./web"
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|