mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
518 lines
20 KiB
HTML
518 lines
20 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">3982</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>272<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
268 store_offset = offset
|
|
269 if lock_indicator:
|
|
270 offset = offset_seed
|
|
271 elif random_indicator:
|
|
272 offset = random.randint(0, 1000000)
|
|
273 elif increment_indicator:
|
|
274 offset = offset_seed + 1
|
|
275 elif decrement_indicator:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>278<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
274 offset = offset_seed + 1
|
|
275 elif decrement_indicator:
|
|
276 offset = offset_seed - 1
|
|
277 else:
|
|
278 offset = random.randint(0, 1000000)
|
|
279 selected_lines = []
|
|
280 with open(file_path, 'r', encoding='utf-8') as file:
|
|
281 file_lines = file.readlines()
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>323<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
319 # select a random word from the | separated list
|
|
320 random.seed(seed)
|
|
321 wc_re = re.compile(r'{([^}]+)}')
|
|
322 def repl(m):
|
|
323 return random.choice(m.group(1).split('|'))
|
|
324 for m in wc_re.finditer(text):
|
|
325 text = text.replace(m.group(0), repl(m))
|
|
326 return text
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>508<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
504
|
|
505 # Iterate through matches
|
|
506 for match in matches:
|
|
507 lower_bound, upper_bound = map(float, match.groups())
|
|
508 random_value = random.uniform(lower_bound, upper_bound)
|
|
509 random_value = round(random_value, 4)
|
|
510
|
|
511 # Append text up to the match and the generated number
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>2085<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
2081 positive_prompt_ = find_and_replace_wildcards(positive_prompt, seed, True)
|
|
2082 negative_prompt_ = find_and_replace_wildcards(negative_prompt, seed, True)
|
|
2083 add_metadata_to_dict(prompt_with_style, positive_prompt=positive_prompt_, negative_prompt=negative_prompt_)
|
|
2084 if len(positive_prompt_) != len(positive_prompt) or len(negative_prompt_) != len(negative_prompt):
|
|
2085 seed += random.randint(0, 1000000)
|
|
2086 positive_prompt = positive_prompt_
|
|
2087 negative_prompt = negative_prompt_
|
|
2088 # extract and load loras
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>2347<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
2343 text = process_random_syntax(text, seed)
|
|
2344 # process wildcards
|
|
2345 text_ = find_and_replace_wildcards(text, seed, True)
|
|
2346 if len(text_) != len(text):
|
|
2347 seed = random.randint(0, 1000000)
|
|
2348 else:
|
|
2349 seed = 1
|
|
2350 # extract and load loras
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
|
|
<b>Test ID:</b> B307<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>3783<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
3779 # Split the string by '+' to identify individual text components
|
|
3780 components = output_text.split(" + ")
|
|
3781
|
|
3782 # Generate the final string for each output
|
|
3783 final_output = delimiter.join(eval(comp, {}, text_dict) for comp in components)
|
|
3784
|
|
3785 outputs.append(final_output)
|
|
3786
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
|
|
<b>Test ID:</b> B307<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>3841<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
3837 # Split the string by '+' to identify individual text components
|
|
3838 components = output_text.split(" + ")
|
|
3839
|
|
3840 # Generate the final string for each output
|
|
3841 final_output = delimiter.join(eval(comp, {}, text_dict) for comp in components)
|
|
3842
|
|
3843 outputs.append(final_output)
|
|
3844
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>3981<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
3977 # wildcard sytax is {like|this}
|
|
3978 # select a random word from the | separated list
|
|
3979 wc_re = re.compile(r'{([^}]+)}')
|
|
3980 def repl(m):
|
|
3981 return random.choice(m.group(1).split('|'))
|
|
3982 for m in wc_re.finditer(text):
|
|
3983 text = text.replace(m.group(0), repl(m))
|
|
3984 prompt.get(str(unique_id))['inputs']['text'] = preserve_text
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-9">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>4351<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
4347 'unusual example of', 'a classic', 'an underrated', 'an innovative','a historical', 'a modern', 'a contemporary',
|
|
4348 'a futuristic', 'a traditional', 'an eco-friendly', 'a controversial', 'a political', 'a religious',
|
|
4349 'a spiritual', 'a philosophical', 'a scientific']
|
|
4350 random.seed(seed)
|
|
4351 prompt = f'{random.choice(spice)} {prompt}'
|
|
4352 request = {
|
|
4353 'user_input': prompt,
|
|
4354 'max_new_tokens': 250,
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-10">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>4385<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
4381 # wildcard sytax is {like|this}
|
|
4382 # select a random word from the | separated list
|
|
4383 wc_re = re.compile(r'{([^}]+)}')
|
|
4384 def repl(m):
|
|
4385 return random.choice(m.group(1).split('|'))
|
|
4386 for m in wc_re.finditer(input_prompt):
|
|
4387 input_prompt = input_prompt.replace(m.group(0), repl(m))
|
|
4388 result = self.api_request(input_prompt, seed, mode, custom_history)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-11">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>4416<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
4412 # wildcard sytax is {like|this}
|
|
4413 # select a random word from the | separated list
|
|
4414 wc_re = re.compile(r'{([^}]+)}')
|
|
4415 def repl(m):
|
|
4416 return random.choice(m.group(1).split('|'))
|
|
4417 for m in wc_re.finditer(input_prompt):
|
|
4418 input_prompt = input_prompt.replace(m.group(0), repl(m))
|
|
4419 # process wildcards
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-12">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>4597<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
4593 'unusual example of', 'a classic', 'an underrated', 'an innovative','a historical', 'a modern', 'a contemporary',
|
|
4594 'a futuristic', 'a traditional', 'an eco-friendly', 'a controversial', 'a political', 'a religious',
|
|
4595 'a spiritual', 'a philosophical', 'a scientific']
|
|
4596 random.seed(seed)
|
|
4597 prompt = f'{random.choice(spice)} {prompt}'
|
|
4598 """
|
|
4599 example curl request to LM Studio
|
|
4600 curl http://localhost:1234/v1/chat/completions \
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-13">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>4650<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
4646 # wildcard sytax is {like|this}
|
|
4647 # select a random word from the | separated list
|
|
4648 wc_re = re.compile(r'{([^}]+)}')
|
|
4649 def repl(m):
|
|
4650 return random.choice(m.group(1).split('|'))
|
|
4651 for m in wc_re.finditer(input_prompt):
|
|
4652 input_prompt = input_prompt.replace(m.group(0), repl(m))
|
|
4653 result = self.api_request(input_prompt, server_address, server_port, seed, mode, custom_history)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-14">
|
|
<div class="issue-block issue-sev-medium">
|
|
<b>blacklist: </b> Use of possibly insecure function - consider using safer ast.literal_eval.<br>
|
|
<b>Test ID:</b> B307<br>
|
|
<b>Severity: </b>MEDIUM<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/mikey_nodes/mikey_nodes.py" target="_blank">/custom_nodes/mikey_nodes/mikey_nodes.py</a><br>
|
|
<b>Line number: </b>4675<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b307-eval</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
4671 def process(self, a, b, formula):
|
|
4672 # eval formula
|
|
4673 formula = formula.replace('a', str(a))
|
|
4674 formula = formula.replace('b', str(b))
|
|
4675 result = eval(formula)
|
|
4676 return (result, int(result), str(result))
|
|
4677
|
|
4678 class ImageOverlay:
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|