jinx/ComfyUI
1
Fork 0
mirror of https://github.com/comfyanonymous/ComfyUI.git synced 2025-08-03 07:26:31 +08:00
Code Issues Activity

PromptServer: Return 400 for empty filename param (#6504)

Browse Source
This commit is contained in:
catboxanon
2025-01-18 17:47:33 -05:00
committed by GitHub
parent 507199d9a8
commit 3a3910f91d
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server.py
View File

@@ -329,6 +329,9 @@ class PromptServer():
original_ref = json.loads(post.get("original_ref")) original_ref = json.loads(post.get("original_ref"))
filename, output_dir = folder_paths.annotated_filepath(original_ref['filename']) filename, output_dir = folder_paths.annotated_filepath(original_ref['filename'])
if not filename:
return web.Response(status=400)
# validation for security: prevent accessing arbitrary path # validation for security: prevent accessing arbitrary path
if filename[0] == '/' or '..' in filename: if filename[0] == '/' or '..' in filename:
return web.Response(status=400) return web.Response(status=400)
@@ -370,6 +373,9 @@ class PromptServer():
filename = request.rel_url.query["filename"] filename = request.rel_url.query["filename"]
filename,output_dir = folder_paths.annotated_filepath(filename) filename,output_dir = folder_paths.annotated_filepath(filename)
if not filename:
return web.Response(status=400)
# validation for security: prevent accessing arbitrary path # validation for security: prevent accessing arbitrary path
if filename[0] == '/' or '..' in filename: if filename[0] == '/' or '..' in filename:
return web.Response(status=400) return web.Response(status=400)