mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
380 lines
13 KiB
HTML
380 lines
13 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">2488</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/clip_utils/clip_interrogator.py" target="_blank">/custom_nodes/eden_comfy_pipelines/clip_utils/clip_interrogator.py</a><br>
|
|
<b>Line number: </b>193<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
189
|
|
190 return best_prompt
|
|
191
|
|
192 def generate_caption(self, pil_image: Image, input_txt = "") -> str:
|
|
193 assert self.caption_model is not None, "No caption model loaded."
|
|
194 self._prepare_caption()
|
|
195
|
|
196 if input_txt:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>request_without_timeout: </b> Requests call without timeout<br>
|
|
<b>Test ID:</b> B113<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>LOW<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/400.html" target="_blank">CWE-400</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/clip_utils/clip_interrogator.py" target="_blank">/custom_nodes/eden_comfy_pipelines/clip_utils/clip_interrogator.py</a><br>
|
|
<b>Line number: </b>420<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b113_request_without_timeout.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
416 return [top_labels[i] for i in tops]
|
|
417
|
|
418
|
|
419 def _download_file(url: str, filepath: str, chunk_size: int = 4*1024*1024, quiet: bool = False):
|
|
420 r = requests.get(url, stream=True)
|
|
421 if r.status_code != 200:
|
|
422 return
|
|
423
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/img_utils/img_nodes.py" target="_blank">/custom_nodes/eden_comfy_pipelines/img_utils/img_nodes.py</a><br>
|
|
<b>Line number: </b>409<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
405 - rescale these crops to have ~target_n_pixels
|
|
406 - return resized images
|
|
407 """
|
|
408
|
|
409 assert len(imgs) > 1
|
|
410 imgs = [np.array(img) for img in imgs]
|
|
411
|
|
412 # Get center crops at same aspect ratio
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/img_utils/img_nodes.py" target="_blank">/custom_nodes/eden_comfy_pipelines/img_utils/img_nodes.py</a><br>
|
|
<b>Line number: </b>571<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
567 files = [os.path.join(folder, f) for f in os.listdir(folder)]
|
|
568 files = [f for f in files if os.path.isfile(f)]
|
|
569
|
|
570 random.seed(seed)
|
|
571 path = random.choice(files)
|
|
572 return (path,)
|
|
573
|
|
574
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
|
|
<b>Test ID:</b> B307<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/img_utils/img_nodes.py" target="_blank">/custom_nodes/eden_comfy_pipelines/img_utils/img_nodes.py</a><br>
|
|
<b>Line number: </b>854<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
850
|
|
851 # Define the mathematical function securely
|
|
852 def safe_eval(expr, x):
|
|
853 allowed_functions = {"sin": np.sin, "cos": np.cos, "exp": np.exp} # Extend this as needed
|
|
854 return eval(expr, {"__builtins__": None}, allowed_functions)
|
|
855
|
|
856 # Create a vectorized version of the safe_eval function
|
|
857 vectorized_func = np.vectorize(lambda x: safe_eval(math_string, x))
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py" target="_blank">/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py</a><br>
|
|
<b>Line number: </b>166<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
162 pos_embed,
|
|
163 cache_dir: str,
|
|
164 non_embedded_image_filenames: str,
|
|
165 ):
|
|
166 assert pos_embed.ndim == 3, f"Expected batch to have 3 dims but got: {pos_embed.ndim} dims"
|
|
167 assert len(non_embedded_image_filenames) == pos_embed.shape[0], f"Expected the batch size of pos_embed ({pos_embed.shape[0]}) to be the same as the number of images found in non_embedded_images_folder: {len(non_embedded_image_filenames)}. non_embedded_image_filenames: {non_embedded_image_filenames}"
|
|
168
|
|
169 all_image_ids = [
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py" target="_blank">/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py</a><br>
|
|
<b>Line number: </b>167<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
163 cache_dir: str,
|
|
164 non_embedded_image_filenames: str,
|
|
165 ):
|
|
166 assert pos_embed.ndim == 3, f"Expected batch to have 3 dims but got: {pos_embed.ndim} dims"
|
|
167 assert len(non_embedded_image_filenames) == pos_embed.shape[0], f"Expected the batch size of pos_embed ({pos_embed.shape[0]}) to be the same as the number of images found in non_embedded_images_folder: {len(non_embedded_image_filenames)}. non_embedded_image_filenames: {non_embedded_image_filenames}"
|
|
168
|
|
169 all_image_ids = [
|
|
170 get_id_from_filename(filename = f)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py" target="_blank">/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py</a><br>
|
|
<b>Line number: </b>220<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
216 delete {id}.pth
|
|
217
|
|
218 run this scan every time the node is run
|
|
219 """
|
|
220 assert os.path.exists(cache_dir), f"Invalid cache_dir: {cache_dir}"
|
|
221
|
|
222 filenames = get_filenames_in_a_folder(folder = cache_dir)
|
|
223 all_image_filenames = find_all_filenames_with_extension(
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-high">
|
|
<b>start_process_with_a_shell: </b> Starting a process with a shell, possible injection detected, security issue.<br>
|
|
<b>Test ID:</b> B605<br>
|
|
<b>Severity: </b>HIGH<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py" target="_blank">/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py</a><br>
|
|
<b>Line number: </b>256<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
252 )
|
|
253
|
|
254 for embedding_filename in embedding_filenames_to_be_deleted:
|
|
255 print(f"[FolderScanner] Deleting: {embedding_filename}")
|
|
256 os.system(
|
|
257 f"rm {embedding_filename}"
|
|
258 )
|
|
259
|
|
260 return (image_filenames_without_embeddings,)
|
|
261
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>assert_used: </b> Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.<br>
|
|
<b>Test ID:</b> B101<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/703.html" target="_blank">CWE-703</a><br>
|
|
<b>File: </b><a href="/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py" target="_blank">/custom_nodes/eden_comfy_pipelines/ip_adapter_utils/moodmix_utils.py</a><br>
|
|
<b>Line number: </b>363<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
359
|
|
360 style_directions = []
|
|
361
|
|
362 # Ensure that num_style_components is not greater than the size of the first dimension
|
|
363 assert num_style_components <= style_embeddings.size(0), "num_style_components is greater than the number of style images!"
|
|
364
|
|
365 for i in range(num_samples):
|
|
366 # Sample the style images to use:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|