ausboss
da60955801
The pack's server still never contacts a host. The info card's button has the browser ask civitai.com about one file by its SHA256, then the server saves the answer beside the LoRA as <model>.civitai.info after checking it names the same file (size, shape and hash). The old Python HTTP call stays gone. release_preflight now allows a raw fetch() only in js/cache_guard and js/lora_loader. SECURITY.md, AGENTS.md, the README and the LoRA Loader help page describe the change.
2.4 KiB
Security
ComfyUI answers /prompt and custom-node routes without a login, so anyone
who can reach a ComfyUI server can queue a workflow or call a node's route.
This pack treats every widget value and route parameter as untrusted and
follows a few fixed rules.
What the pack does and does not do
- Files stay inside ComfyUI's folders. Save Image writes only to
ComfyUI's output folder or a subfolder of it, and Save Video checks its
prefix and final file the same way. Load Video picks from the input
folder; the video transform nodes' local path mode reads only from the
input, output and temp folders, and their uploader streams into the input
folder. Absolute paths,
..,~, Windows drive and alternate-stream syntax, UNC paths and symlinks that lead outside those folders are refused. - The server makes no network requests. The pack's Python code never
contacts a host. The one exception is a button you click: LoRA Loader's
Fetch Civitai info has your browser ask civitai.com about that one
LoRA, by its SHA256 hash, and the answer is saved beside the LoRA as
<model>.civitai.info(inside ComfyUI's LoRA folders). The pack checks that the answer describes the same file before saving it. Nothing is sent until you click, and the button can be turned off in the node's settings. - No code execution. Math Expression parses its text into an allowlisted syntax tree of arithmetic and a few math functions; it never runs Python source. The pack starts no subprocesses and installs nothing at runtime.
- No automatic downloads. You place model weights (LaMa, RAFT optical flow) yourself; the pack never fetches them.
- No raw HTML from workflows. Workflow Note renders its Markdown into
text nodes, and its links open only
http(s)addresses.
scripts/release_preflight.py fails a release whose shipped code contains an
HTTP or socket client.
These rules protect a ComfyUI server from the requests it receives. They do not defend against someone who can already change files on the ComfyUI machine, and exposing ComfyUI beyond a trusted network is still a risk of its own.
Reporting a vulnerability
Report privately through this repository's Security tab → Report a vulnerability. If that option is not offered, open an issue asking for a private contact and leave the details out of it.
Fixes land on main and ship in the next release; the
CHANGELOG records security-relevant changes.