ausboss
9a0f80c483
Both were point-in-time reports whose status lines had gone stale and whose evidence lived only in untracked scratch folders. What still holds moved to AGENTS.md (registry history, example workflow rules) and SECURITY.md (what the rules do not cover); CHANGELOG.md already records the changes they described.
2.1 KiB
Security
ComfyUI answers /prompt and custom-node routes without a login, so anyone
who can reach a ComfyUI server can queue a workflow or call a node's route.
This pack treats every widget value and route parameter as untrusted and
follows a few fixed rules.
What the pack does and does not do
- Files stay inside ComfyUI's folders. Save Image writes only to
ComfyUI's output folder or a subfolder of it, and Save Video checks its
prefix and final file the same way. Load Video picks from the input
folder; the video transform nodes' local path mode reads only from the
input, output and temp folders, and their uploader streams into the input
folder. Absolute paths,
..,~, Windows drive and alternate-stream syntax, UNC paths and symlinks that lead outside those folders are refused. - No network requests. Nothing in the pack contacts a host. LoRA
Loader reads a
.civitai.infosidecar that another tool left beside a LoRA, but never fetches one. - No code execution. Math Expression parses its text into an allowlisted syntax tree of arithmetic and a few math functions; it never runs Python source. The pack starts no subprocesses and installs nothing at runtime.
- No automatic downloads. You place model weights (LaMa, RAFT optical flow) yourself; the pack never fetches them.
- No raw HTML from workflows. Workflow Note renders its Markdown into
text nodes, and its links open only
http(s)addresses.
scripts/release_preflight.py fails a release whose shipped code contains an
HTTP or socket client.
These rules protect a ComfyUI server from the requests it receives. They do not defend against someone who can already change files on the ComfyUI machine, and exposing ComfyUI beyond a trusted network is still a risk of its own.
Reporting a vulnerability
Report privately through this repository's Security tab → Report a vulnerability. If that option is not offered, open an issue asking for a private contact and leave the details out of it.
Fixes land on main and ship in the next release; the
CHANGELOG records security-relevant changes.