Setup Node refactor (the secret-bearing fields no longer exist on the
node at all):
• Removed app_key / app_secret / auth_code from INPUT_TYPES. The
Setup Node now exposes only storage_method, encryption_key_method,
and reconnect — none of which are credentials.
• Added a "Set credentials..." button on the node (LiteGraph button
widget installed via beforeRegisterNodeDef + onNodeCreated
prototype hook so it survives reload, drag-and-drop workflow
JSON, and PNG metadata restore).
• Click opens a browser-only modal with three <input type=password>
fields. Browser-native dot masking the whole time the user types
or pastes — no canvas-rendered plaintext, no shoulder-surf.
• Modal Save POSTs values to a new same-origin route
/dropsend/setup/stash and closes. setup() consumes the stash
entry on the next Queue (one-shot, keyed by client_id, 60-second
TTL, 32-entry cap with oldest-eviction).
• Architectural consequence: secrets never become widget values, so
they cannot enter saved workflow JSON, ComfyUI's localStorage
auto-save, PNG metadata, copy-pasted nodes, or PromptServer.history
(and therefore the unauthenticated /history HTTP endpoint).
Auto-curl auth flow (one-click second paste):
• After Run 1 prints the OAuth URL banner, setup() sends a
sid-targeted dropsend_credentials_needed WebSocket event.
• JS handler auto-opens the entry modal in the originating browser
so the user can paste auth_code as soon as Dropbox shows it,
without clicking the button between runs.
• Defense in depth: client_id is echoed in the WS payload and the
JS handler verifies it matches api.clientId before opening.
Security hardening on /dropsend/setup/stash:
• Same-origin enforcement: Origin header must match request.host.
Closes cross-origin CSRF from another browser tab even when an
attacker has sniffed a victim's client_id.
• Content-Type lockdown: rejects anything other than
application/json with HTTP 415. Closes the confused-deputy class
where form-encoded bodies could be parsed as JSON.
• Live-session check: client_id must correspond to an active
PromptServer.instance.sockets entry. Returns 403 otherwise.
Closes the stash-poisoning vector where an attacker who guesses
a victim's client_id could pre-populate credentials.
• Per-IP rate limit: 30 POSTs / 10-second sliding window, returns
429 over budget. Defense against stash-spam DoS attempting to
evict a legitimate user's entry.
• Body cap (32 KB), client_id regex validation, JSON parse errors
return 400, empty payloads dropped.
• Both rate-limit and live-session checks empirically verified via
curl smoke tests.
Reconnect now revokes the Dropbox refresh token at the source:
• reconnect=True populates DropboxAuthManager from os.environ and
calls reset(revoke_token=True).
• POST /2/auth/token/revoke with an 8-second timeout so a Dropbox
outage cannot hang the operator mid-reconnect. Local cleanup
proceeds regardless of revocation outcome.
• Revocation outcome is now logged at logger.error level (not just
print) and the failure message tells the operator to manually
disconnect at https://www.dropbox.com/account/connected_apps so
a silent revocation failure cannot leave a still-valid token at
Dropbox.
Logging:
• Single FileHandler attached to the root logger from __init__.py,
pointed at a plugin-relative dropsend.log. Replaces the four
duplicated logging.basicConfig() blocks in monitor_output.py /
encrypt_file.py / dropbox_upload.py / dropsend_uploader_node.py
that were dead code (basicConfig is a no-op once ComfyUI has
already configured root). Log records from every DropSend module
now actually persist to disk.
• Race-free creation: pre-create with os.open(O_CREAT | O_WRONLY |
O_APPEND, 0o600) before FileHandler attaches, follow-up chmod as
belt-and-suspenders. Closes the brief default-umask window
between FileHandler creating the file and post-hoc chmod.
• Rotation via RotatingFileHandler (5 MB per file, 3 backups, ~20
MB max). Bounds disk use on long-lived hosts.
• dropbox_auth_manager.py now has its own logger so revocation
successes/failures land in dropsend.log alongside stdout.
Tests (tests/ directory, unittest, no extra deps):
• test_safe_paths.py — 23 tests covering symlink rejection, path-
traversal rejection, allowlist behaviour, dropbox_dest validation
(NUL bytes, missing leading slash, parent-traversal segments),
and resolve_safe_watch_folder edge cases. safe_paths is the only
barrier between remote workflow inputs and arbitrary-file-read
on the host; this is regression coverage for that barrier.
• test_setup_node_security.py — static AST analysis of
dropsend_setup_node.py asserting that every send_sync call for a
credential event passes a non-None sid AND sits inside an
"if sid:" guard. Catches future regressions of the original
WebSocket-broadcast vulnerability deterministically. Also asserts
INPUT_TYPES never re-introduces app_key/app_secret/auth_code.
WebSocket-broadcast guard maintained on all three event sites
(dropsend_credentials_ready, dropbox_reconnect_complete,
dropsend_credentials_needed) — refuse to send when client_id is None
to prevent send_sync(..., None) from broadcasting credentials to
every connected browser tab.
README:
• New Changelog section documenting the v1.1.0 security advisory
(workflow-persistence + WS-broadcast leaks in earlier versions)
and the fixes shipped in this release.
• New "Bind ComfyUI to localhost or front it with auth" Best
Practice item (item 4) explicitly calling out that ComfyUI's
/prompt endpoint is unauthenticated.
• New "Encryption key rotation" subsection covering symmetric-key
implications, leaked-key recovery, and how to generate a new key.
• New "Uninstalling / disconnecting" subsection with step-by-step
instructions for revoking Dropbox app, resetting app secret,
removing platform secrets, and handling existing .enc files.
• Threat model reflects same-origin/Content-Type checks, log
rotation, plugin-directory metadata-leak note for multi-tenant
hosts, reconnect-revocation silent-failure note, and Dropbox
SDK error-message log review.
.gitignore:
• Expanded to cover *.bak, *.enc, *.key/.pem/.p12/.pfx, .idea/,
.pytest_cache/, build artifacts, Thumbs.db/Desktop.ini.
Bundled in this minor release:
• Single-Observer fix for the macOS _fsevents conflict that
previously prevented .enc files from being picked up by the
upload watcher.
• folder_format dropdown for AutoUploader (project_name default
plus five worldwide date formats), with two-base persistence so
switching between project-name and dated modes preserves both
patterns.
• RUNNING banner with per-setting plain-English explanations.
• Branded watching/encrypted/sent log emojis.
• Per-shell copy-paste commands and echo verification for the
COMFYUI_DROPSEND_ALLOW_SETUP gate.
82 lines
3.4 KiB
Python
82 lines
3.4 KiB
Python
# ComfyUI_DropSendNode/__init__.py
|
|
# Register DropSend Setup + AutoUploader nodes
|
|
import os
|
|
import logging
|
|
import logging.handlers
|
|
from dotenv import load_dotenv
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Logging
|
|
# ---------------------------------------------------------------------------
|
|
# Attach a FileHandler to the root logger so every child logger in this
|
|
# plugin (`logging.getLogger(__name__)` in our modules) gets its records
|
|
# persisted to dropsend.log alongside ComfyUI's own stdout. We do NOT
|
|
# use logging.basicConfig() here: ComfyUI's main.py configures the root
|
|
# logger before our package is imported, and basicConfig is a no-op
|
|
# once any caller has already configured root.
|
|
#
|
|
# Race-free perms: pre-create the file with 0o600 via os.open() before
|
|
# FileHandler can create it under the default umask (typically 0o644).
|
|
# A follow-up chmod tightens perms if the file already existed with
|
|
# looser bits.
|
|
_LOG_PATH = os.path.join(os.path.dirname(__file__), "dropsend.log")
|
|
try:
|
|
_fd = os.open(_LOG_PATH, os.O_CREAT | os.O_WRONLY | os.O_APPEND, 0o600)
|
|
os.close(_fd)
|
|
except OSError:
|
|
pass
|
|
_root_logger = logging.getLogger()
|
|
if not any(
|
|
isinstance(h, logging.FileHandler)
|
|
and getattr(h, "baseFilename", "") == _LOG_PATH
|
|
for h in _root_logger.handlers
|
|
):
|
|
try:
|
|
# Rotating handler caps disk use: 5 MB per file, 3 backups +
|
|
# current = 4 files = ~20 MB max. On a busy host, plain
|
|
# FileHandler grows unbounded over months; rotation prevents
|
|
# a tiny background process from filling someone's home dir.
|
|
_fh = logging.handlers.RotatingFileHandler(
|
|
_LOG_PATH,
|
|
maxBytes=5 * 1024 * 1024,
|
|
backupCount=3,
|
|
)
|
|
_fh.setFormatter(
|
|
logging.Formatter("%(asctime)s - %(levelname)s - %(name)s - %(message)s")
|
|
)
|
|
_root_logger.addHandler(_fh)
|
|
# If ComfyUI didn't set a root level (or set it higher than INFO),
|
|
# raise enough that our INFO records actually reach the handler.
|
|
if _root_logger.level == logging.NOTSET or _root_logger.level > logging.INFO:
|
|
_root_logger.setLevel(logging.INFO)
|
|
except OSError:
|
|
pass
|
|
try:
|
|
os.chmod(_LOG_PATH, 0o600)
|
|
except OSError:
|
|
pass
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# .env loading
|
|
# ---------------------------------------------------------------------------
|
|
# Load .env from the plugin directory at import time so DROPBOX_APP_KEY,
|
|
# DROPBOX_APP_SECRET, DROPBOX_REFRESH_TOKEN, COMFYUI_ENCRYPTION_KEY, and
|
|
# the uploader's persisted settings are visible in os.environ before any
|
|
# node runs. override=False is intentional — host-injected env vars
|
|
# (RunPod secrets, Docker env, systemd EnvironmentFile) take precedence
|
|
# over the plugin's local .env.
|
|
_PLUGIN_ENV = os.path.join(os.path.dirname(__file__), ".env")
|
|
if os.path.exists(_PLUGIN_ENV):
|
|
load_dotenv(_PLUGIN_ENV, override=False)
|
|
|
|
from .dropsend_uploader_node import NODE_CLASS_MAPPINGS as RUN_CLASS, NODE_DISPLAY_NAME_MAPPINGS as RUN_DISPLAY
|
|
from .dropsend_setup_node import NODE_CLASS_MAPPINGS as SETUP_CLASS, NODE_DISPLAY_NAME_MAPPINGS as SETUP_DISPLAY
|
|
NODE_CLASS_MAPPINGS = {}
|
|
NODE_CLASS_MAPPINGS.update(RUN_CLASS)
|
|
NODE_CLASS_MAPPINGS.update(SETUP_CLASS)
|
|
NODE_DISPLAY_NAME_MAPPINGS = {}
|
|
NODE_DISPLAY_NAME_MAPPINGS.update(RUN_DISPLAY)
|
|
NODE_DISPLAY_NAME_MAPPINGS.update(SETUP_DISPLAY)
|
|
# Define web directory for JavaScript extensions
|
|
WEB_DIRECTORY = "./web"
|