mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
zeekay
84ca3e48e7
Fix Python/JS identifiers that had spaces inserted by the ComfyUI → Hanzo Studio replacement (e.g. class names, variable prefixes). Spaces in identifiers cause syntax errors.
217 lines
5.9 KiB
HTML
217 lines
5.9 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">1695</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/hanzo-studio-prompt-control/prompt_control/node_clip.py" target="_blank">/custom_nodes/hanzo-studio-prompt-control/prompt_control/node_clip.py</a><br>
|
|
<b>Line number: </b>97<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
93 return all_res
|
|
94
|
|
95
|
|
96 def get_control_points(schedule, steps, encoder):
|
|
97 assert len(steps) > 1
|
|
98 new_steps = set(steps)
|
|
99
|
|
100 for step in (s[0] for s in schedule if s[0] >= steps[0] and s[0] <= steps[-1]):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>hardcoded_password_default: </b> Possible hardcoded password: 'none'<br>
|
|
<b>Test ID:</b> B107<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/259.html" target="_blank">CWE-259</a><br>
|
|
<b>File: </b><a href="/custom_nodes/hanzo-studio-prompt-control/prompt_control/node_clip.py" target="_blank">/custom_nodes/hanzo-studio-prompt-control/prompt_control/node_clip.py</a><br>
|
|
<b>Line number: </b>205<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b107_hardcoded_password_default.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b107_hardcoded_password_default.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
201
|
|
202 return style, normalization, text
|
|
203
|
|
204
|
|
205 def encode_regions(clip, tokens, regions, weight_interpretation="comfy", token_normalization="none"):
|
|
206 from custom_nodes.HanzoStudio_Cutoff.cutoff import CLIPSetRegion, finalize_clip_regions
|
|
207
|
|
208 clip_regions = {
|
|
209 "clip": clip,
|
|
210 "base_tokens": tokens,
|
|
211 "regions": [],
|
|
212 "targets": [],
|
|
213 "weights": [],
|
|
214 }
|
|
215
|
|
216 strict_mask = 1.0
|
|
217 start_from_masked = 1.0
|
|
218 mask_token = ""
|
|
219
|
|
220 for region in regions:
|
|
221 region_text, target_text, w, sm, sfm, mt = region
|
|
222 if w is not None:
|
|
223 w = safe_float(w, 0)
|
|
224 else:
|
|
225 w = 1.0
|
|
226 if sm is not None:
|
|
227 strict_mask = safe_float(sm, 1.0)
|
|
228 if sfm is not None:
|
|
229 start_from_masked = safe_float(sfm, 1.0)
|
|
230 if mt is not None:
|
|
231 mask_token = mt
|
|
232 log.info("Region: text %s, target %s, weight %s", region_text.strip(), target_text.strip(), w)
|
|
233 (clip_regions,) = CLIPSetRegion.add_clip_region(None, clip_regions, region_text, target_text, w)
|
|
234 log.info("Regions: mask_token=%s strict_mask=%s start_from_masked=%s", mask_token, strict_mask, start_from_masked)
|
|
235
|
|
236 (r,) = finalize_clip_regions(
|
|
237 clip_regions, mask_token, strict_mask, start_from_masked, token_normalization, weight_interpretation
|
|
238 )
|
|
239 cond, pooled = r[0][0], r[0][1].get("pooled_output")
|
|
240 return cond, pooled
|
|
241
|
|
242
|
|
243 SHUFFLE_GEN = torch.Generator(device="cpu")
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>hardcoded_password_string: </b> Possible hardcoded password: ''<br>
|
|
<b>Test ID:</b> B105<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>MEDIUM<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/259.html" target="_blank">CWE-259</a><br>
|
|
<b>File: </b><a href="/custom_nodes/hanzo-studio-prompt-control/prompt_control/node_clip.py" target="_blank">/custom_nodes/hanzo-studio-prompt-control/prompt_control/node_clip.py</a><br>
|
|
<b>Line number: </b>218<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b105_hardcoded_password_string.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b105_hardcoded_password_string.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
214 }
|
|
215
|
|
216 strict_mask = 1.0
|
|
217 start_from_masked = 1.0
|
|
218 mask_token = ""
|
|
219
|
|
220 for region in regions:
|
|
221 region_text, target_text, w, sm, sfm, mt = region
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|