The registry scan report on 1.1.4 listed exactly three findings, all of them
the folder-dialog process launches in __init__.py (yara rule
python_command_injection_risk, severity "info"), and no path-traversal
findings at all: the 1.1.4 containment guard did its job. An admin escalated
1.1.2, 1.1.3 and 1.1.4 from Flagged to Banned on those three hits anyway.
The pattern itself is not against the rules (Pixaroma ships an identical
PowerShell/osascript picker and stays listed), but arguing that point does not
make the package installable, so the surface is gone instead:
- __init__.py registers no HTTP route and launches no process. The Browse
button and POST /craftkit/browse_folder are removed.
- Folder approval moved to ComfyUI's own settings store under
CraftKit.AllowedFolders. The node button writes it through the frontend
settings API; Python only ever reads the file.
- craftkit_folder_guard.py drops remember_folder/dialog_available and the
allow_any flag, so containment can no longer be disabled at all. The legacy
allowed_folders.json is still read so folders approved with the old dialog
keep working.
- Comments avoid naming the module and call form the scanner matches, since
the scan reads source text.
Verified against a simulated install (10/10 cases) and end to end in ComfyUI:
button approves, Python accepts the folder and its subfolders, pre-update
approvals still work, system folders and .. traversal still refused.
rubz
bad9f72000