xinyun/ComfyUI
1
0
Fork 0
mirror of https://git.datalinker.icu/comfyanonymous/ComfyUI synced 2026-08-30 05:03:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

PromptServer: Return 400 for empty filename param (#6504)

Browse Source
This commit is contained in:
catboxanon 2025-01-18 17:47:33 -05:00 committed by GitHub
parent 39b2c8eeee
commit 06ad126a81
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
server.py
View File

@ -329,6 +329,9 @@ class PromptServer():
original_ref = json.loads(post.get("original_ref")) original_ref = json.loads(post.get("original_ref"))
filename, output_dir = folder_paths.annotated_filepath(original_ref['filename']) filename, output_dir = folder_paths.annotated_filepath(original_ref['filename'])
if not filename:
return web.Response(status=400)
# validation for security: prevent accessing arbitrary path # validation for security: prevent accessing arbitrary path
if filename[0] == '/' or '..' in filename: if filename[0] == '/' or '..' in filename:
return web.Response(status=400) return web.Response(status=400)
@ -370,6 +373,9 @@ class PromptServer():
filename = request.rel_url.query["filename"] filename = request.rel_url.query["filename"]
filename,output_dir = folder_paths.annotated_filepath(filename) filename,output_dir = folder_paths.annotated_filepath(filename)
if not filename:
return web.Response(status=400)
# validation for security: prevent accessing arbitrary path # validation for security: prevent accessing arbitrary path
if filename[0] == '/' or '..' in filename: if filename[0] == '/' or '..' in filename:
return web.Response(status=400) return web.Response(status=400)