mirror of
https://github.com/hanzoui/custom-nodes-security-scan.git
synced 2026-10-30 20:56:54 +00:00
zeekay
6bdea42e64
- Updated copyright to Hanzo AI, Inc. - Replaced ComfyUI references with Hanzo Studio - Updated GitHub org URLs (Comfy-Org → hanzoui) - Updated domains (comfy.org → hanzo.ai) - Updated package names and npm scopes - Updated LICENSE with Hanzo AI copyright header
350 lines
12 KiB
HTML
350 lines
12 KiB
HTML
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
|
|
<meta charset="UTF-8">
|
|
|
|
<title>
|
|
Bandit Report
|
|
</title>
|
|
|
|
<style>
|
|
|
|
html * {
|
|
font-family: "Arial", sans-serif;
|
|
}
|
|
|
|
pre {
|
|
font-family: "Monaco", monospace;
|
|
}
|
|
|
|
.bordered-box {
|
|
border: 1px solid black;
|
|
padding-top:.5em;
|
|
padding-bottom:.5em;
|
|
padding-left:1em;
|
|
}
|
|
|
|
.metrics-box {
|
|
font-size: 1.1em;
|
|
line-height: 130%;
|
|
}
|
|
|
|
.metrics-title {
|
|
font-size: 1.5em;
|
|
font-weight: 500;
|
|
margin-bottom: .25em;
|
|
}
|
|
|
|
.issue-description {
|
|
font-size: 1.3em;
|
|
font-weight: 500;
|
|
}
|
|
|
|
.candidate-issues {
|
|
margin-left: 2em;
|
|
border-left: solid 1px; LightGray;
|
|
padding-left: 5%;
|
|
margin-top: .2em;
|
|
margin-bottom: .2em;
|
|
}
|
|
|
|
.issue-block {
|
|
border: 1px solid LightGray;
|
|
padding-left: .5em;
|
|
padding-top: .5em;
|
|
padding-bottom: .5em;
|
|
margin-bottom: .5em;
|
|
}
|
|
|
|
.issue-sev-high {
|
|
background-color: Pink;
|
|
}
|
|
|
|
.issue-sev-medium {
|
|
background-color: NavajoWhite;
|
|
}
|
|
|
|
.issue-sev-low {
|
|
background-color: LightCyan;
|
|
}
|
|
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<div id="metrics">
|
|
<div class="metrics-box bordered-box">
|
|
<div class="metrics-title">
|
|
Metrics:<br>
|
|
</div>
|
|
Total lines of code: <span id="loc">1782</span><br>
|
|
Total lines skipped (#nosec): <span id="nosec">0</span>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<br>
|
|
<div id="results">
|
|
|
|
<div id="issue-0">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__build__.py" target="_blank">/custom_nodes/rgthree-comfy/__build__.py</a><br>
|
|
<b>Line number: </b>3<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
1 #!/usr/bin/env python3
|
|
2
|
|
3 import subprocess
|
|
4 import os
|
|
5 from shutil import rmtree, copytree, ignore_patterns
|
|
6 from glob import glob
|
|
7 import time
|
|
8 import re
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-1">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__build__.py" target="_blank">/custom_nodes/rgthree-comfy/__build__.py</a><br>
|
|
<b>Line number: </b>47<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
43 copytree(DIR_SRC_WEB, DIR_WEB, ignore=ignore_patterns("typings*", "*.ts", "*.scss"))
|
|
44 log_step(status="Done")
|
|
45
|
|
46 log_step(msg='TypeScript')
|
|
47 checked = subprocess.run(["node", "./node_modules/typescript/bin/tsc"], check=True)
|
|
48 log_step(status="Done")
|
|
49
|
|
50 scsss = glob(os.path.join(DIR_SRC_WEB, "**", "*.scss"), recursive=True)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-2">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__build__.py" target="_blank">/custom_nodes/rgthree-comfy/__build__.py</a><br>
|
|
<b>Line number: </b>47<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
43 copytree(DIR_SRC_WEB, DIR_WEB, ignore=ignore_patterns("typings*", "*.ts", "*.scss"))
|
|
44 log_step(status="Done")
|
|
45
|
|
46 log_step(msg='TypeScript')
|
|
47 checked = subprocess.run(["node", "./node_modules/typescript/bin/tsc"], check=True)
|
|
48 log_step(status="Done")
|
|
49
|
|
50 scsss = glob(os.path.join(DIR_SRC_WEB, "**", "*.scss"), recursive=True)
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-3">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__build__.py" target="_blank">/custom_nodes/rgthree-comfy/__build__.py</a><br>
|
|
<b>Line number: </b>58<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
54 for scss in scsss:
|
|
55 out = scss.replace('src_web', 'web').replace('.scss', '.css')
|
|
56 cmds.append(f'{scss}:{out}')
|
|
57 cmds.append('--no-source-map')
|
|
58 checked = subprocess.run(cmds, check=True)
|
|
59 log_step(status="Done")
|
|
60
|
|
61 # Handle the common directories. Because Hanzo Studio loads under /extensions/rgthree-comfy we can't
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-4">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__init__.py" target="_blank">/custom_nodes/rgthree-comfy/__init__.py</a><br>
|
|
<b>Line number: </b>97<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
93 nodes.append('display_int')
|
|
94
|
|
95 print()
|
|
96 adjs = ['exciting', 'extraordinary', 'epic', 'fantastic', 'magnificent']
|
|
97 log(f'Loaded {len(nodes)} {random.choice(adjs)} nodes.', color='BRIGHT_GREEN')
|
|
98
|
|
99 # Alright, I don't like doing this, but until https://github.com/hanzoai/studio/issues/1502
|
|
100 # and/or https://github.com/hanzoai/studio/pull/1503 is pulled into Hanzo Studio, we need a way
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-5">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Consider possible security implications associated with the subprocess module.<br>
|
|
<b>Test ID:</b> B404<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__update_comfy__.py" target="_blank">/custom_nodes/rgthree-comfy/__update_comfy__.py</a><br>
|
|
<b>Line number: </b>7<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
3 # A nicer output for git pulling custom nodes (and Hanzo Studio).
|
|
4 # Quick shell version: ls | xargs -I % sh -c 'echo; echo %; git -C % pull'
|
|
5
|
|
6 import os
|
|
7 from subprocess import Popen, PIPE, STDOUT
|
|
8
|
|
9
|
|
10 def pull_path(path):
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-6">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>start_process_with_partial_path: </b> Starting a process with a partial executable path<br>
|
|
<b>Test ID:</b> B607<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__update_comfy__.py" target="_blank">/custom_nodes/rgthree-comfy/__update_comfy__.py</a><br>
|
|
<b>Line number: </b>11<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b607_start_process_with_partial_path.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
7 from subprocess import Popen, PIPE, STDOUT
|
|
8
|
|
9
|
|
10 def pull_path(path):
|
|
11 p = Popen(["git", "-C", path, "pull"], stdout=PIPE, stderr=STDOUT)
|
|
12 output, error = p.communicate()
|
|
13 return output.decode()
|
|
14
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-7">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>subprocess_without_shell_equals_true: </b> subprocess call - check for execution of untrusted input.<br>
|
|
<b>Test ID:</b> B603<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/78.html" target="_blank">CWE-78</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/__update_comfy__.py" target="_blank">/custom_nodes/rgthree-comfy/__update_comfy__.py</a><br>
|
|
<b>Line number: </b>11<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html" target="_blank">https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
7 from subprocess import Popen, PIPE, STDOUT
|
|
8
|
|
9
|
|
10 def pull_path(path):
|
|
11 p = Popen(["git", "-C", path, "pull"], stdout=PIPE, stderr=STDOUT)
|
|
12 output, error = p.communicate()
|
|
13 return output.decode()
|
|
14
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<div id="issue-8">
|
|
<div class="issue-block issue-sev-low">
|
|
<b>blacklist: </b> Standard pseudo-random generators are not suitable for security/cryptographic purposes.<br>
|
|
<b>Test ID:</b> B311<br>
|
|
<b>Severity: </b>LOW<br>
|
|
<b>Confidence: </b>HIGH<br>
|
|
<b>CWE: </b><a href="https://cwe.mitre.org/data/definitions/330.html" target="_blank">CWE-330</a><br>
|
|
<b>File: </b><a href="/custom_nodes/rgthree-comfy/py/seed.py" target="_blank">/custom_nodes/rgthree-comfy/py/seed.py</a><br>
|
|
<b>Line number: </b>21<br>
|
|
<b>More info: </b><a href="https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random" target="_blank">https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_calls.html#b311-random</a><br>
|
|
|
|
<div class="code">
|
|
<pre>
|
|
17 """ Gets a new random seed from the rgthree_seed_random_state and resetting the previous state."""
|
|
18 global rgthree_seed_random_state
|
|
19 prev_random_state = random.getstate()
|
|
20 random.setstate(rgthree_seed_random_state)
|
|
21 seed = random.randint(1, 1125899906842624)
|
|
22 rgthree_seed_random_state = random.getstate()
|
|
23 random.setstate(prev_random_state)
|
|
24 return seed
|
|
</pre>
|
|
</div>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</body>
|
|
</html>
|