rubz
dca216b0a2
The registry's HIGH-severity finding was never the COM/folder-picker code we suspected in 1.1.1-1.1.3 — it's smart_batch_resize.py's input_folder widget accepting any path and writing to it, an unconfined filesystem write reachable via unauthenticated POST /prompt. Found via the undocumented ?include_status_reason=true parameter on the versions API. Adds craftkit_folder_guard.py (pattern adapted from Pixaroma's _path_guard.py): a folder is only usable if it's inside ComfyUI's own input/output/temp directories, or the user picked it in the native OS folder dialog at some point (the click-OK happens outside anything a request can reach), or allow_any is hand-edited into the config. Also fixes a PowerShell console window flashing open behind the folder dialog (missing CREATE_NO_WINDOW).
21 lines
726 B
TOML
21 lines
726 B
TOML
[project]
|
|
name = "comfyui-craftkit"
|
|
description = "Smart resize, batch resize, resolution multiplier and prompt controller nodes for ComfyUI"
|
|
version = "1.1.4"
|
|
readme = "README.md"
|
|
requires-python = ">=3.10"
|
|
license = { file = "LICENSE" }
|
|
# Pillow, NumPy, and PyTorch all ship with ComfyUI itself — intentionally not
|
|
# re-declared here to avoid version conflicts with ComfyUI's own pins.
|
|
dependencies = []
|
|
classifiers = [
|
|
"Operating System :: OS Independent",
|
|
]
|
|
|
|
[project.urls]
|
|
Repository = "https://github.com/CraftopiaStudio/ComfyUI-CraftKit"
|
|
|
|
[tool.comfy]
|
|
PublisherId = "craftopiastudio"
|
|
DisplayName = "ComfyUI-CraftKit"
|
|
Icon = "https://raw.githubusercontent.com/CraftopiaStudio/ComfyUI-CraftKit/main/assets/icon.png" |