google-labs-jules[bot]andAEmotionStudio
73b31156f4
Add input validation using ShaderParamsReader.validate_and_sanitize_params to prevent saving malformed or malicious data to shader_params.json. Create .jules/sentinel.md with security learnings. Co-authored-by: AEmotionStudio <163354043+AEmotionStudio@users.noreply.github.com>
54 lines
1.9 KiB
Python
54 lines
1.9 KiB
Python
"""
|
|
API routes for ShaderNoiseKSampler extension.
|
|
|
|
Provides server-side endpoints for saving shader parameters from the frontend.
|
|
"""
|
|
|
|
from aiohttp import web
|
|
import json
|
|
import os
|
|
from .shader_params_reader import ShaderParamsReader
|
|
|
|
# Get extension directory
|
|
EXTENSION_DIR = os.path.dirname(os.path.abspath(__file__))
|
|
|
|
|
|
async def save_shader_params(request):
|
|
"""
|
|
API endpoint to save shader parameters to JSON file.
|
|
|
|
Receives JSON data from the frontend and writes it to data/shader_params.json.
|
|
This enables automatic parameter persistence without manual file downloads.
|
|
"""
|
|
try:
|
|
data = await request.json()
|
|
params_file = os.path.join(EXTENSION_DIR, "data", "shader_params.json")
|
|
|
|
# Ensure data directory exists
|
|
os.makedirs(os.path.dirname(params_file), exist_ok=True)
|
|
|
|
# Validate and sanitize input data before saving
|
|
# This prevents storing potentially malicious or malformed data
|
|
sanitized_data = ShaderParamsReader.validate_and_sanitize_params(data)
|
|
|
|
with open(params_file, 'w') as f:
|
|
json.dump(sanitized_data, f, indent=2)
|
|
|
|
print(f"[ShaderNoiseKSampler] Saved shader params to {params_file}")
|
|
return web.json_response({"status": "success"})
|
|
except Exception as e:
|
|
print(f"[ShaderNoiseKSampler] Error saving shader params: {e}")
|
|
return web.json_response({"status": "error", "message": str(e)}, status=500)
|
|
|
|
|
|
def setup_routes(server):
|
|
"""
|
|
Register API routes with ComfyUI's PromptServer.
|
|
|
|
Args:
|
|
server: The PromptServer instance from ComfyUI
|
|
"""
|
|
if hasattr(server, 'app') and hasattr(server.app, 'router'):
|
|
server.app.router.add_post("/shader_noise_ksampler/save_params", save_shader_params)
|
|
print("[ShaderNoiseKSampler] Registered API route: POST /shader_noise_ksampler/save_params")
|