Metrics:
Total lines of code: 1710
Total lines skipped (#nosec): 0

blacklist: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/nodes.py
Line number: 4
More info: https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess
1	import os
2	import sys
3	import json
4	import subprocess
5	import numpy as np
6	import re
7	import datetime
8	from typing import List
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/nodes.py
Line number: 84
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
80	    video_format_path = folder_paths.get_full_path("VHS_video_formats", format_name + ".json")
81	    with open(video_format_path, 'r') as stream:
82	        video_format = json.load(stream)
83	    for w in gen_format_widgets(video_format):
84	        assert(w[0][0] in kwargs)
85	        w[0] = str(kwargs[w[0][0]])
86	    return video_format
87	
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/nodes.py
Line number: 116
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
112	        with open(metadata_path, "w") as f:
113	            f.write(";FFMETADATA1\n")
114	            f.write(metadata)
115	        m_args = args[:1] + ["-i", metadata_path] + args[1:] + ["-metadata", "creation_time=now"]
116	        with subprocess.Popen(m_args + [file_path], stderr=subprocess.PIPE,
117	                              stdin=subprocess.PIPE, env=env) as proc:
118	            try:
119	                while frame_data is not None:
120	                    proc.stdin.write(frame_data)
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/nodes.py
Line number: 138
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
134	                #Res was not set
135	                print(err.decode("utf-8"), end="", file=sys.stderr)
136	                logger.warn("An error occurred when saving with metadata")
137	    if res != b'':
138	        with subprocess.Popen(args + [file_path], stderr=subprocess.PIPE,
139	                              stdin=subprocess.PIPE, env=env) as proc:
140	            try:
141	                while frame_data is not None:
142	                    proc.stdin.write(frame_data)
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/nodes.py
Line number: 396
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
392	                gif_output_path = os.path.join( full_output_folder, gif_output)
393	                gifski_args = [gifski_path] + video_format["gifski_pass"] \
394	                        + ["-o", gif_output_path, file_path]
395	                try:
396	                    res = subprocess.run(gifski_args, env=env, check=True, capture_output=True)
397	                except subprocess.CalledProcessError as e:
398	                    raise Exception("An error occured in the gifski subprocess:\n" \
399	                            + e.stderr.decode("utf-8"))
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/nodes.py
Line number: 426
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
422	                            + video_format["audio_pass"] \
423	                            + ["-af", "apad", "-shortest", output_file_with_audio_path]
424	
425	                try:
426	                    res = subprocess.run(mux_args, input=audio(), env=env,
427	                                         capture_output=True, check=True)
428	                except subprocess.CalledProcessError as e:
429	                    raise Exception("An error occured in the ffmpeg subprocess:\n" \
430	                            + e.stderr.decode("utf-8"))
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/nodes.py
Line number: 542
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
538	
539	    def prune_outputs(self, filenames, options):
540	        if len(filenames[1]) == 0:
541	            return ()
542	        assert(len(filenames[1]) <= 3 and len(filenames[1]) >= 2)
543	        delete_list = []
544	        if options in ["Intermediate", "Intermediate and Utility", "All"]:
545	            delete_list += filenames[1][1:-1]
blacklist: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/server.py
Line number: 5
More info: https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess
1	import server
2	import folder_paths
3	import os
4	import time
5	import subprocess
6	from .utils import is_url, get_sorted_dir_files_from_directory, ffmpeg_path, validate_sequence
7	from comfy.k_diffusion.utils import FolderOfImages
8	
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/server.py
Line number: 111
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
107	
108	    args += ['-c:v', 'libvpx-vp9','-deadline', 'realtime', '-cpu-used', '8', '-f', 'webm', '-']
109	
110	    try:
111	        with subprocess.Popen(args, stdout=subprocess.PIPE) as proc:
112	            try:
113	                resp = web.StreamResponse()
114	                resp.content_type = 'video/webm'
blacklist: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/utils.py
Line number: 5
More info: https://bandit.readthedocs.io/en/1.7.9/blacklists/blacklist_imports.html#b404-import-subprocess
1	import hashlib
2	import os
3	from typing import Iterable
4	import shutil
5	import subprocess
6	import re
7	
8	import server
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/utils.py
Line number: 18
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
14	DIMMAX = 8192
15	
16	def ffmpeg_suitability(path):
17	    try:
18	        version = subprocess.run([path, "-version"], check=True,
19	                                 capture_output=True).stdout.decode("utf-8")
20	    except:
21	        return 0
22	    score = 0
assert_used: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: CWE-703
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/utils.py
Line number: 126
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b101_assert_used.html
122	    prompt_queue.put((number, prompt_id, prompt, extra_data, outputs_to_execute))
123	
124	requeue_guard = [None, 0, 0, {}]
125	def requeue_workflow(requeue_required=(-1,True)):
126	    assert(len(prompt_queue.currently_running) == 1)
127	    global requeue_guard
128	    (run_number, _, prompt, _, _) = next(iter(prompt_queue.currently_running.values()))
129	    if requeue_guard[0] != run_number:
subprocess_without_shell_equals_true: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: CWE-78
File: /custom_nodes/ComfyUI-VideoHelperSuite/videohelpersuite/utils.py
Line number: 152
More info: https://bandit.readthedocs.io/en/1.7.9/plugins/b603_subprocess_without_shell_equals_true.html
148	        args += ["-ss", str(start_time)]
149	    if duration > 0:
150	        args += ["-t", str(duration)]
151	    try:
152	        res =  subprocess.run(args + ["-f", "wav", "-"],
153	                              stdout=subprocess.PIPE, check=True).stdout
154	    except subprocess.CalledProcessError as e:
155	        logger.warning(f"Failed to extract audio from: {file}")
156	        return False