From 8182dc8bed37ba26cd6ce08a28545bfee2a387dc Mon Sep 17 00:00:00 2001
From: Sirshendu Ganguly <sirshendu.ganguly2015@gmail.com>
Date: Mon, 2 Feb 2026 11:02:38 -0500
Subject: [PATCH] fixes

---
 clientlibs/utils.js        |  5 +++--
 modules/save3D.py          | 12 +++++++++---
 modules/threeDInference.py |  2 +-
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/clientlibs/utils.js b/clientlibs/utils.js
index 2f3d6ab..af10901 100644
--- a/clientlibs/utils.js
+++ b/clientlibs/utils.js
@@ -73,8 +73,9 @@ function mediaUUIDHandler(msgEvent) {
 function save3DFilepathHandler(msgEvent) {
     const data = msgEvent.detail;
     const filepath = data.filepath;
-    const nodeID = parseInt(data.nodeID);
-    
+    const nodeID = parseInt(data.nodeID, 10);
+    if (Number.isNaN(nodeID)) return false;
+
     if(data.success && filepath) {
         const node = app.graph.getNodeById(nodeID);
         if(node !== null && node !== undefined) {
diff --git a/modules/save3D.py b/modules/save3D.py
index 8598ff9..a75ead3 100644
--- a/modules/save3D.py
+++ b/modules/save3D.py
@@ -1,6 +1,7 @@
 from .utils import runwareUtils as rwUtils
 import folder_paths
 import os
+import re
 import requests
 from datetime import datetime
 
@@ -58,9 +59,15 @@ class RunwareSave3D:
         if extension not in ["glb", "ply"]:
             raise Exception(f"Unsupported 3D file extension '{extension}' from URL. Expected .glb or .ply.")
 
+        # Sanitize filename_prefix to prevent path traversal or arbitrary subdir creation
+        prefix_basename = os.path.basename(
+            filename_prefix.replace(os.sep, "_").replace(os.altsep or os.sep, "_")
+        )
+        safe_prefix = re.sub(r"[^\w\-]", "", prefix_basename) or "ComfyUI"
+
         # Generate filename with timestamp
         timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-        filename = f"{filename_prefix}_{timestamp}.{extension}"
+        filename = f"{safe_prefix}_{timestamp}.{extension}"
         filepath = os.path.join(threed_output_dir, filename)
 
         # Download with retry logic
@@ -93,8 +100,7 @@ class RunwareSave3D:
                 # Send filepath to UI (like media upload mediaUUID)
                 rwUtils.sendSave3DFilepath(filepath, kwargs.get("node_id"))
 
-                # Return filepath as output and UI info for ComfyUI
-                return (filepath, {"ui": {"text": [f"Saved: {filename}"]}})
+                return {"result": (filepath,), "ui": {"text": (f"Saved: {filename}",)}}
 
             except requests.exceptions.RequestException as e:
                 print(f"[Runware Save 3D] Attempt {attempt + 1} failed: {e}")
diff --git a/modules/threeDInference.py b/modules/threeDInference.py
index f6c396a..f90fddc 100644
--- a/modules/threeDInference.py
+++ b/modules/threeDInference.py
@@ -97,7 +97,7 @@ class threeDInference:
             print(f"[DEBUG] Response: {rwUtils.safe_json_dumps(genResult, indent=2)}")
 
         except Exception as e:
-            raise e
+            raise
 
         # Extract task UUID for polling
         taskUUID = genConfig[0]["taskUUID"]