Files

518 lines
20 KiB
HTML

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>
Bandit Report
</title>
<style>
html * {
font-family: "Arial", sans-serif;
}
pre {
font-family: "Monaco", monospace;
}
.bordered-box {
border: 1px solid black;
padding-top:.5em;
padding-bottom:.5em;
padding-left:1em;
}
.metrics-box {
font-size: 1.1em;
line-height: 130%;
}
.metrics-title {
font-size: 1.5em;
font-weight: 500;
margin-bottom: .25em;
}
.issue-description {
font-size: 1.3em;
font-weight: 500;
}
.candidate-issues {
margin-left: 2em;
border-left: solid 1px; LightGray;
padding-left: 5%;
margin-top: .2em;
margin-bottom: .2em;
}
.issue-block {
border: 1px solid LightGray;
padding-left: .5em;
padding-top: .5em;
padding-bottom: .5em;
margin-bottom: .5em;
}
.issue-sev-high {
background-color: Pink;
}
.issue-sev-medium {
background-color: NavajoWhite;
}
.issue-sev-low {
background-color: LightCyan;
}
</style>
</head>
<body>
<div id="metrics">
<div class="metrics-box bordered-box">
<div class="metrics-title">
Metrics:<br>
</div>
Total lines of code: <span id="loc">3982</span><br>
Total lines skipped (#nosec): <span id="nosec">0</span>
</div>
</div>
<br>
<div id="results">
<div id="issue-0">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>272<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
268 store_offset = offset
269 if lock_indicator:
270 offset = offset_seed
271 elif random_indicator:
272 offset = random.randint(0, 1000000)
273 elif increment_indicator:
274 offset = offset_seed + 1
275 elif decrement_indicator:
</pre>
</div>
</div>
</div>
<div id="issue-1">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>278<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
274 offset = offset_seed + 1
275 elif decrement_indicator:
276 offset = offset_seed - 1
277 else:
278 offset = random.randint(0, 1000000)
279 selected_lines = []
280 with open(file_path, &#x27;r&#x27;, encoding=&#x27;utf-8&#x27;) as file:
281 file_lines = file.readlines()
</pre>
</div>
</div>
</div>
<div id="issue-2">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>323<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
319 # select a random word from the | separated list
320 random.seed(seed)
321 wc_re = re.compile(r&#x27;{([^}]+)}&#x27;)
322 def repl(m):
323 return random.choice(m.group(1).split(&#x27;|&#x27;))
324 for m in wc_re.finditer(text):
325 text = text.replace(m.group(0), repl(m))
326 return text
</pre>
</div>
</div>
</div>
<div id="issue-3">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>508<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
504
505 # Iterate through matches
506 for match in matches:
507 lower_bound, upper_bound = map(float, match.groups())
508 random_value = random.uniform(lower_bound, upper_bound)
509 random_value = round(random_value, 4)
510
511 # Append text up to the match and the generated number
</pre>
</div>
</div>
</div>
<div id="issue-4">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>2085<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
2081 positive_prompt_ = find_and_replace_wildcards(positive_prompt, seed, True)
2082 negative_prompt_ = find_and_replace_wildcards(negative_prompt, seed, True)
2083 add_metadata_to_dict(prompt_with_style, positive_prompt=positive_prompt_, negative_prompt=negative_prompt_)
2084 if len(positive_prompt_) != len(positive_prompt) or len(negative_prompt_) != len(negative_prompt):
2085 seed += random.randint(0, 1000000)
2086 positive_prompt = positive_prompt_
2087 negative_prompt = negative_prompt_
2088 # extract and load loras
</pre>
</div>
</div>
</div>
<div id="issue-5">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>2347<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
2343 text = process_random_syntax(text, seed)
2344 # process wildcards
2345 text_ = find_and_replace_wildcards(text, seed, True)
2346 if len(text_) != len(text):
2347 seed = random.randint(0, 1000000)
2348 else:
2349 seed = 1
2350 # extract and load loras
</pre>
</div>
</div>
</div>
<div id="issue-6">
<div class="issue-block issue-sev-medium">
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
<b>Test ID:</b> B307<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>3783<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
<div class="code">
<pre>
3779 # Split the string by &#x27;+&#x27; to identify individual text components
3780 components = output_text.split(&quot; + &quot;)
3781
3782 # Generate the final string for each output
3783 final_output = delimiter.join(eval(comp, {}, text_dict) for comp in components)
3784
3785 outputs.append(final_output)
3786
</pre>
</div>
</div>
</div>
<div id="issue-7">
<div class="issue-block issue-sev-medium">
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
<b>Test ID:</b> B307<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>3841<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
<div class="code">
<pre>
3837 # Split the string by &#x27;+&#x27; to identify individual text components
3838 components = output_text.split(&quot; + &quot;)
3839
3840 # Generate the final string for each output
3841 final_output = delimiter.join(eval(comp, {}, text_dict) for comp in components)
3842
3843 outputs.append(final_output)
3844
</pre>
</div>
</div>
</div>
<div id="issue-8">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>3981<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
3977 # wildcard sytax is {like|this}
3978 # select a random word from the | separated list
3979 wc_re = re.compile(r&#x27;{([^}]+)}&#x27;)
3980 def repl(m):
3981 return random.choice(m.group(1).split(&#x27;|&#x27;))
3982 for m in wc_re.finditer(text):
3983 text = text.replace(m.group(0), repl(m))
3984 prompt.get(str(unique_id))[&#x27;inputs&#x27;][&#x27;text&#x27;] = preserve_text
</pre>
</div>
</div>
</div>
<div id="issue-9">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>4351<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
4347 &#x27;unusual example of&#x27;, &#x27;a classic&#x27;, &#x27;an underrated&#x27;, &#x27;an innovative&#x27;,&#x27;a historical&#x27;, &#x27;a modern&#x27;, &#x27;a contemporary&#x27;,
4348 &#x27;a futuristic&#x27;, &#x27;a traditional&#x27;, &#x27;an eco-friendly&#x27;, &#x27;a controversial&#x27;, &#x27;a political&#x27;, &#x27;a religious&#x27;,
4349 &#x27;a spiritual&#x27;, &#x27;a philosophical&#x27;, &#x27;a scientific&#x27;]
4350 random.seed(seed)
4351 prompt = f&#x27;{random.choice(spice)} {prompt}&#x27;
4352 request = {
4353 &#x27;user_input&#x27;: prompt,
4354 &#x27;max_new_tokens&#x27;: 250,
</pre>
</div>
</div>
</div>
<div id="issue-10">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>4385<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
4381 # wildcard sytax is {like|this}
4382 # select a random word from the | separated list
4383 wc_re = re.compile(r&#x27;{([^}]+)}&#x27;)
4384 def repl(m):
4385 return random.choice(m.group(1).split(&#x27;|&#x27;))
4386 for m in wc_re.finditer(input_prompt):
4387 input_prompt = input_prompt.replace(m.group(0), repl(m))
4388 result = self.api_request(input_prompt, seed, mode, custom_history)
</pre>
</div>
</div>
</div>
<div id="issue-11">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>4416<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
4412 # wildcard sytax is {like|this}
4413 # select a random word from the | separated list
4414 wc_re = re.compile(r&#x27;{([^}]+)}&#x27;)
4415 def repl(m):
4416 return random.choice(m.group(1).split(&#x27;|&#x27;))
4417 for m in wc_re.finditer(input_prompt):
4418 input_prompt = input_prompt.replace(m.group(0), repl(m))
4419 # process wildcards
</pre>
</div>
</div>
</div>
<div id="issue-12">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>4597<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
4593 &#x27;unusual example of&#x27;, &#x27;a classic&#x27;, &#x27;an underrated&#x27;, &#x27;an innovative&#x27;,&#x27;a historical&#x27;, &#x27;a modern&#x27;, &#x27;a contemporary&#x27;,
4594 &#x27;a futuristic&#x27;, &#x27;a traditional&#x27;, &#x27;an eco-friendly&#x27;, &#x27;a controversial&#x27;, &#x27;a political&#x27;, &#x27;a religious&#x27;,
4595 &#x27;a spiritual&#x27;, &#x27;a philosophical&#x27;, &#x27;a scientific&#x27;]
4596 random.seed(seed)
4597 prompt = f&#x27;{random.choice(spice)} {prompt}&#x27;
4598 &quot;&quot;&quot;
4599 example curl request to LM Studio
4600 curl http://localhost:1234/v1/chat/completions \
</pre>
</div>
</div>
</div>
<div id="issue-13">
<div class="issue-block issue-sev-low">
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
<b>Test ID:</b> B311<br>
<b>Severity: </b>LOW<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>4650<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
<div class="code">
<pre>
4646 # wildcard sytax is {like|this}
4647 # select a random word from the | separated list
4648 wc_re = re.compile(r&#x27;{([^}]+)}&#x27;)
4649 def repl(m):
4650 return random.choice(m.group(1).split(&#x27;|&#x27;))
4651 for m in wc_re.finditer(input_prompt):
4652 input_prompt = input_prompt.replace(m.group(0), repl(m))
4653 result = self.api_request(input_prompt, server_address, server_port, seed, mode, custom_history)
</pre>
</div>
</div>
</div>
<div id="issue-14">
<div class="issue-block issue-sev-medium">
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
<b>Test ID:</b> B307<br>
<b>Severity: </b>MEDIUM<br>
<b>Confidence: </b>HIGH<br>
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
<b>Line number: </b>4675<br>
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
<div class="code">
<pre>
4671 def process(self, a, b, formula):
4672 # eval formula
4673 formula = formula.replace(&#x27;a&#x27;, str(a))
4674 formula = formula.replace(&#x27;b&#x27;, str(b))
4675 result = eval(formula)
4676 return (result, int(result), str(result))
4677
4678 class ImageOverlay:
</pre>
</div>
</div>
</div>
</div>
</body>
</html>