KOFiblto-ComfyUI-SaturnNodes

Files

T

KOFiblto c3375c61af fix(security): resolve reviewer findings with CSRF protection, ticket handshakes, path confinement, and in-memory authorization

- Issue 1 (Power CSRF): Implement cryptographic session CSRF tokens, Sec-Fetch-Site and Origin verification, plus an ephemeral single-use 30s ticket handshake (/leafflow/power/request_token -> /confirm_action) for restart/shutdown actions.
- Issue 2 (Settings CSRF): Protect /leafflow/settings and /leafflow/scrapes/clear with is_authenticated_local_request; completely remove ALLOW_ANY_SCRIPT_PATH setting; default ENABLE_LOCAL_FILE_EXECUTION to false.
- Issue 3 (Script Path Confinement): Strictly confine RunLocalFileNode execution to ComfyUI/scripts/ using canonical os.path.realpath and os.path.commonpath; reject absolute paths and directory traversal (..); eliminate ALLOW_ANY_SCRIPT_PATH escape hatches.
- Issue 4 (Consent Gate Traveling in Workflow JSON): Remove security_consent from node INPUT_TYPES to prevent serialization in workflow JSON or image metadata; replace with an interactive in-memory authorization button on the canvas node ([⚡ Authorize Run]) with a 5-minute single-use memory token.
- Expand automated unit test suite to 105 tests covering all security guards and token mechanics. Update SECURITY.md, CHANGELOG.md, and README.md.

2026-09-22 17:10:36 +02:00

fix(security): resolve reviewer findings with CSRF protection, ticket handshakes, path confinement, and in-memory authorization

2026-09-22 17:10:36 +02:00

batch_queue.js

refactor(batch-queue): remove live queue progress badge

2026-09-12 01:43:12 +02:00

leafflow_colors.js

feat(prompt): add custom regex to PromptQueueIterator and add PromptCounter node with live badge

2026-09-11 17:50:01 +02:00

leafflow_settings.js

fix(security): resolve reviewer findings with CSRF protection, ticket handshakes, path confinement, and in-memory authorization

2026-09-22 17:10:36 +02:00