xinyun/ComfyUI
1
0
Fork 0
mirror of https://git.datalinker.icu/comfyanonymous/ComfyUI synced 2026-08-04 05:56:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): do not leak authentification for the absolute urls

Browse Source
This commit is contained in:
bigcat88 2025-10-23 09:50:39 +03:00
parent b34bc7987b
commit fab58ddfa1
No known key found for this signature in database
GPG Key ID: 1F0BF0EC3CF22721
2 changed files with 15 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
comfy_api_nodes/util/client.py
View File

@ -482,18 +482,6 @@ def _unpack_tuple(t: tuple) -> tuple[str, Any, str]:
raise ValueError("files tuple must be (filename, file[, content_type])") raise ValueError("files tuple must be (filename, file[, content_type])")
def _join_url(base_url: str, path: str) -> str:
return urljoin(base_url.rstrip("/") + "/", path.lstrip("/"))
def _merge_headers(node_cls: type[IO.ComfyNode], endpoint_headers: dict[str, str]) -> dict[str, str]:
headers = {"Accept": "*/*"}
headers.update(get_auth_header(node_cls))
if endpoint_headers:
headers.update(endpoint_headers)
return headers
def _merge_params(endpoint_params: dict[str, Any], method: str, data: Optional[dict[str, Any]]) -> dict[str, Any]: def _merge_params(endpoint_params: dict[str, Any], method: str, data: Optional[dict[str, Any]]) -> dict[str, Any]:
params = dict(endpoint_params or {}) params = dict(endpoint_params or {})
if method.upper() == "GET" and data: if method.upper() == "GET" and data:
@ -566,7 +554,11 @@ def _snapshot_request_body_for_logging(
async def _request_base(cfg: _RequestConfig, expect_binary: bool): async def _request_base(cfg: _RequestConfig, expect_binary: bool):
"""Core request with retries, per-second interruption monitoring, true cancellation, and friendly errors.""" """Core request with retries, per-second interruption monitoring, true cancellation, and friendly errors."""
url = _join_url(default_base_url(), cfg.endpoint.path) url = cfg.endpoint.path
parsed_url = urlparse(url)
if not parsed_url.scheme and not parsed_url.netloc: # is URL relative?
url = urljoin(default_base_url().rstrip("/") + "/", url.lstrip("/"))
method = cfg.endpoint.method method = cfg.endpoint.method
params = _merge_params(cfg.endpoint.query_params, method, cfg.data if method == "GET" else None) params = _merge_params(cfg.endpoint.query_params, method, cfg.data if method == "GET" else None)
@ -598,7 +590,12 @@ async def _request_base(cfg: _RequestConfig, expect_binary: bool):
operation_id = _generate_operation_id(method, cfg.endpoint.path, attempt) operation_id = _generate_operation_id(method, cfg.endpoint.path, attempt)
logging.debug("[DEBUG] HTTP %s %s (attempt %d)", method, url, attempt) logging.debug("[DEBUG] HTTP %s %s (attempt %d)", method, url, attempt)
payload_headers = _merge_headers(cfg.node_cls, cfg.endpoint.headers) payload_headers = {"Accept": "*/*"}
if not parsed_url.scheme and not parsed_url.netloc: # is URL relative?
payload_headers.update(get_auth_header(cfg.node_cls))
if cfg.endpoint.headers:
payload_headers.update(cfg.endpoint.headers)
payload_kw: dict[str, Any] = {"headers": payload_headers} payload_kw: dict[str, Any] = {"headers": payload_headers}
if method == "GET": if method == "GET":
payload_headers.pop("Content-Type", None) payload_headers.pop("Content-Type", None)

7
comfy_api_nodes/util/download_helpers.py
View File

@ -4,7 +4,7 @@ import uuid
from io import BytesIO from io import BytesIO
from pathlib import Path from pathlib import Path
from typing import IO, Optional, Union from typing import IO, Optional, Union
from urllib.parse import urlparse from urllib.parse import urljoin, urlparse
import aiohttp import aiohttp
import torch import torch
@ -57,10 +57,11 @@ async def download_url_to_bytesio(
delay = retry_delay delay = retry_delay
headers: dict[str, str] = {} headers: dict[str, str] = {}
if url.startswith("/proxy/"): parsed_url = urlparse(url)
if not parsed_url.scheme and not parsed_url.netloc: # is URL relative?
if cls is None: if cls is None:
raise ValueError("For relative 'cloud' paths, the `cls` parameter is required.") raise ValueError("For relative 'cloud' paths, the `cls` parameter is required.")
url = default_base_url().rstrip("/") + url url = urljoin(default_base_url().rstrip("/") + "/", url.lstrip("/"))
headers = get_auth_header(cls) headers = get_auth_header(cls)
while True: while True: