- _confine_to_base now uses dedicated base dirs (input/user/output) instead of ComfyUI root
- _strip_legacy_prefix keeps old input/... user/... output/... values working
- add tooltips to the three path widgets
- update defaults and README path-constraint section (v2.1.2)
- verified with test_path_confine.py (21/21) and test_smoke_narrowed.py
Addresses maintainer review feedback on Comfy-Org/ComfyUI-Manager#3183.
Path traversal:
- Add _confine_to_base(), which resolves the real path (following symlinks)
and verifies it stays inside the ComfyUI root directory. Applied to
folder_path, log_folder and output_folder.
- Previously an absolute path was trusted verbatim and relative paths could
escape via '..', allowing a graph to read arbitrary files and to write or
delete .json files anywhere the server could reach.
- Log clearing now only removes JSON files previously written by this node
(validated by the 'prompt_file' key) instead of every .json in the folder.
UI localization:
- Node display name and all widget labels are now English.
ReSerendipity