rubz
bad9f72000
The registry scan report on 1.1.4 listed exactly three findings, all of them the folder-dialog process launches in __init__.py (yara rule python_command_injection_risk, severity "info"), and no path-traversal findings at all: the 1.1.4 containment guard did its job. An admin escalated 1.1.2, 1.1.3 and 1.1.4 from Flagged to Banned on those three hits anyway. The pattern itself is not against the rules (Pixaroma ships an identical PowerShell/osascript picker and stays listed), but arguing that point does not make the package installable, so the surface is gone instead: - __init__.py registers no HTTP route and launches no process. The Browse button and POST /craftkit/browse_folder are removed. - Folder approval moved to ComfyUI's own settings store under CraftKit.AllowedFolders. The node button writes it through the frontend settings API; Python only ever reads the file. - craftkit_folder_guard.py drops remember_folder/dialog_available and the allow_any flag, so containment can no longer be disabled at all. The legacy allowed_folders.json is still read so folders approved with the old dialog keep working. - Comments avoid naming the module and call form the scanner matches, since the scan reads source text. Verified against a simulated install (10/10 cases) and end to end in ComfyUI: button approves, Python accepts the folder and its subfolders, pre-update approvals still work, system folders and .. traversal still refused.
23 lines
908 B
TOML
23 lines
908 B
TOML
[project]
|
|
name = "comfyui-craftkit"
|
|
description = "Smart resize, batch resize, resolution multiplier and prompt controller nodes for ComfyUI"
|
|
version = "1.1.5"
|
|
readme = "README.md"
|
|
requires-python = ">=3.10"
|
|
license = { file = "LICENSE" }
|
|
# Pillow, NumPy, and PyTorch all ship with ComfyUI itself — intentionally not
|
|
# re-declared here to avoid version conflicts with ComfyUI's own pins.
|
|
dependencies = []
|
|
keywords = ["comfyui", "resize", "batch-resize", "resolution", "prompt", "upscale", "image-processing", "lora"]
|
|
classifiers = [
|
|
"Operating System :: OS Independent",
|
|
]
|
|
|
|
[project.urls]
|
|
Repository = "https://github.com/CraftopiaStudio/ComfyUI-CraftKit"
|
|
Issues = "https://github.com/CraftopiaStudio/ComfyUI-CraftKit/issues"
|
|
|
|
[tool.comfy]
|
|
PublisherId = "craftopiastudio"
|
|
DisplayName = "ComfyUI-CraftKit"
|
|
Icon = "https://raw.githubusercontent.com/CraftopiaStudio/ComfyUI-CraftKit/main/assets/icon.png" |