nodes/ComfyAssets-ComfyUI_PromptManager
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(tooling): reject lookalike toolkit download URLs (#186)

Browse Source
This commit is contained in:
Vito Sansevero
2026-10-16 22:12:22 -07:00
parent cde61bffbb
commit 5160dbe703
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/vendor/vendor-toolkit.test.mjs
Vendored
+15
View File
@@ -45,3 +45,18 @@ test('toolkit sync rejects moving pins, identity mismatches and missing sources
assert.throws(() => syncToolkit({ root: third.root }), /ENOENT/);
assert.throws(() => readFileSync(join(third.destination, 'core.js')), /ENOENT/);
});
test('toolkit sync rejects lookalike download hosts and archive paths before writing', t => {
for (const prefix of [
'https://codeloadXgithub.com/ComfyAssets/ComfyAssets-Toolkit/tar.gz/',
'https://codeload.githubXcom/ComfyAssets/ComfyAssets-Toolkit/tar.gz/',
'https://codeload.github.com/ComfyAssets/ComfyAssets-Toolkit/tarXgz/',
]) {
const f = fixture(t);
const resolved = prefix + 'a'.repeat(40);
writeFileSync(join(f.tooling, 'package.json'), JSON.stringify({ devDependencies: { '@comfyassets/toolkit': resolved } }));
writeFileSync(join(f.tooling, 'package-lock.json'), JSON.stringify({ packages: { 'node_modules/@comfyassets/toolkit': { version: '0.1.0', resolved, integrity: 'sha512-fixture' } } }));
assert.throws(() => syncToolkit({ root: f.root }), /immutable commit pin/);
assert.throws(() => readFileSync(join(f.destination, 'core.js')), /ENOENT/);
}
});
tools/vendor/vendor-toolkit.mjs
Vendored
+1 -1
View File
@@ -8,7 +8,7 @@ export function syncToolkit({ root = repositoryRoot, check = false } = {}) {
const tooling = join(root, 'tools/vendor');
const readJson = path => JSON.parse(readFileSync(path, 'utf8'));
const pin = readJson(join(tooling, 'package.json')).devDependencies['@comfyassets/toolkit'];
if (!/^https:\/\/codeload.github.com\/ComfyAssets\/ComfyAssets-Toolkit\/tar.gz\/[a-f0-9]{40}$/.test(pin)) throw new Error('Toolkit needs an immutable commit pin');
if (!/^https:\/\/codeload\.github\.com\/ComfyAssets\/ComfyAssets-Toolkit\/tar\.gz\/[a-f0-9]{40}$/.test(pin)) throw new Error('Toolkit needs an immutable commit pin');
const locked = readJson(join(tooling, 'package-lock.json')).packages['node_modules/@comfyassets/toolkit'];
const installed = join(tooling, 'node_modules/@comfyassets/toolkit');
const info = readJson(join(installed, 'package.json'));