From 5d54025133384ef80dba133b434cab4b66b5c264 Mon Sep 17 00:00:00 2001
From: Meisoftcoltd <38667978+Meisoftcoltd@users.noreply.github.com>
Date: Fri, 6 Feb 2026 13:30:19 +0000
Subject: [PATCH] security: Gate Interact node debug REPL behind environment
 variable

This commit addresses a security vulnerability where the `Interact` node
exposed an interactive Python shell (`code.interact`) by default, allowing
arbitrary code execution.

Changes:
- Modified `debug.Interact.interact` to check for `COMFYUI_SB_ENABLE_INTERACTIVE_DEBUG` environment variable.
- The REPL is now disabled by default. It only activates if the variable is set to "1", "true", or "yes".
- Added a warning message when the node is executed without the flag.
- Updated the node's docstring to include a security warning and instructions.

Verification:
- Verified that `code.interact` is not called by default.
- Verified that `code.interact` is called when the environment variable is set.
- Confirmed `import os` exists in `debug.py`.
---
 debug.py | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/debug.py b/debug.py
index 73b01ab..a20e157 100644
--- a/debug.py
+++ b/debug.py
@@ -60,7 +60,13 @@ class Quitter:
 
 @register_node
 class Interact:
-    """Opens an interactive REPL whenever the node is evaluated."""
+    """
+    Opens an interactive REPL whenever the node is evaluated.
+
+    SECURITY WARNING: This node allows arbitrary code execution.
+    To enable it, you must set the environment variable:
+    COMFYUI_SB_ENABLE_INTERACTIVE_DEBUG=1
+    """
     @classmethod
     def INPUT_TYPES(s):
         return {
@@ -75,6 +81,10 @@ class Interact:
     OUTPUT_NODE = True
 
     def interact(self, **kwargs):
+        if os.environ.get("COMFYUI_SB_ENABLE_INTERACTIVE_DEBUG", "").lower() not in ("true", "1", "yes"):
+            print(f"[{self.__class__.__name__}] Interactive debugging is disabled. Set COMFYUI_SB_ENABLE_INTERACTIVE_DEBUG=1 to enable.")
+            return ()
+
         if sys.__stdout__.isatty():
             with RestoreStdStreams():
                 code.interact(