Merge pull request #211 from anupamme/fix-repo-comfyui-custom-nodes-alekpet-v004-path-traversal-painter-node

fix: all http endpoints registered via promptserver in painter_node.py

PainterNode/painter_node.py

@@ -37,8 +37,11 @@ PREFIX = "_setting.json"
 def isFileName(filename):
     if (
         not filename
-        and filename is not None
-        and (type(filename) == str and filename.strip() == "")
+        or not isinstance(filename, str)
+        or filename.strip() == ""
+        or "/" in filename
+        or "\\" in filename
+        or ".." in filename
     ):
         print("Filename is incorrect")
         return False