Alexopus
bc798df250
`path` and `filename` are free-form strings that can come from a workflow's JSON, not just a person typing into the local UI. Only the final path segment was ever sanitized (make_pathname/sanitize_filename), so a value like `../../../etc` or an absolute path could make ImageSaver.save_images() create directories and write the image/JSON sidecar outside ComfyUI's output directory (CWE-22/CWE-73). This is what caused v1.24.0 to be banned on the Comfy Registry (Comfy-Org/registry-backend#206). Add utils.resolve_within_output(), which joins path pieces onto folder_paths.output_directory, resolves symlinks, and rejects the result if it escapes that directory. Apply it everywhere ImageSaver.save_images() turns `path`/`filename` into a filesystem path: the output directory itself, the final image target, and the optional workflow-JSON sidecar. Nested relative subfolders (e.g. `portraits/2026-08-27`) still work; `..`, absolute paths, and symlink escapes are now rejected before anything is created. Covered by a new tests/ suite (tests/test_paths.py), since exercising nodes.py requires stubbing ComfyUI's runtime (see tests/conftest.py). Fixes alexopus/ComfyUI-Image-Saver#138
4 lines
48 B
INI
4 lines
48 B
INI
[pytest]
|
|
testpaths = .
|
|
python_files = test_*.py
|