From 78fd20d89a9df631dbbe4f2f6dd101e9e84c6c8d Mon Sep 17 00:00:00 2001 From: Vito Sansevero Date: Tue, 13 Oct 2026 06:38:23 -0700 Subject: [PATCH] fix(local_image_loader): load the resolved path that was validated --- kikotools/tools/local_image_loader/node.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kikotools/tools/local_image_loader/node.py b/kikotools/tools/local_image_loader/node.py index 73cebb0..3409d4f 100644 --- a/kikotools/tools/local_image_loader/node.py +++ b/kikotools/tools/local_image_loader/node.py @@ -143,7 +143,9 @@ class LocalImageLoaderNode(ComfyAssetsBaseNode): # Load image if selected image_selection = node_selections.get("image") if image_selection and image_selection.get("path"): - image_path = image_selection["path"] + # Load the resolved path we validated, so a symlink swapped after + # the check can't redirect the read. + image_path = resolve_path(image_selection["path"]) if not is_allowed_image_path(image_path, get_allowed_roots()): # selections.json may have been tampered with logger.warning("Refusing to load disallowed path: %s", image_path)