wangbo/ComfyUI-Manager
1
0
Fork 0
mirror of https://github.com/Comfy-Org/ComfyUI-Manager.git synced 2026-07-26 18:17:30 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(security): add dedicated install flags decoupled from security_level

Browse Source 
Gate 'install via git URL' and 'install via pip' with dedicated opt-in
boolean flags (allow_git_url_install / allow_pip_install) in config.ini
[default], fully replacing the security_level term on those surfaces
(REPLACE, not AND — a strict level no longer denies when the flag is on;
a weak level no longer allows when the flag is off).

- glob/manager_server.py: pure predicate is_dedicated_install_allowed
  (flag AND loopback, request-time args.listen); REPLACE gates at
  /customnode/install/git_url and /customnode/install/pip; batch
  unknown-URL arm routes through the same full predicate at the risky
  position (loopback term is load-bearing — the middle entry gate has
  no network-position term; the entry gate itself stays in force);
  unknown-pip in batch stays unconditionally blocked; new
  SECURITY_MESSAGE_FLAG_* denial constants name the responsible flag;
  security_403_response gains flag_token (comfyui_outdated keeps precedence)
- glob/manager_core.py: register both keys (read via get_bool default-false,
  write list, exception fallback); "true"-only truthy; restart-only activation
- js/common.js: 403 dialog copy names the responsible flag at the two
  install call sites
- README.md: security-policy docs for both flags (per-surface scope incl.
  the batch entry-gate qualifier, REPLACE decoupling, loopback bound,
  opt-in config snippet, default-deny + migration note); stale tier lists
  corrected against the actual gates
- CHANGELOG.md: opt-in migration note + accepted residual risk (flags
  bypass the forced-strong outdated-ComfyUI hardening on loopback,
  opt-in only), decoupling claim qualified for the batch entry gate

Tests: unit suite (predicate truth table, REPLACE litmus both directions,
AST binding-proofs against live handlers, subprocess-isolated config
contract) plus a real-server E2E suite that mounts the Manager-under-test
via git worktree (exact-SHA pin, detached) against a real ComfyUI and
exercises both flag surfaces and both arms — deny arms (403 + flag-naming
body/log + no install artifact), git-URL allow arm (real clone), pip allow
arm as a two-phase reservation oracle — with zero-residual self-clean.
Module skips without E2E_COMFYUI_ROOT; unit suite unaffected.

The manager-v4 branch ships the identical policy (shared invariants +
config contract); this tree uses the degraded predicate 'flag AND
loopback' (no personal_cloud-equivalent mode here).
This commit is contained in:
Dr.Lt.Data
2026-06-15 02:44:26 +09:00
parent 3772432847
commit 6288fb0e2a
25 changed files with 9998 additions and 8815 deletions
Download Patch File Download Diff File Expand all files Collapse all files
node_db/dev/custom-node-list.json
+20
View File
@@ -1282,6 +1282,16 @@
"install_type": "git-clone",
"description": "A streamlined ComfyUI extension that adds an AI-powered chat interface to the sidebar for converting complex briefs/specs into generation-ready prompts. (Description by CC)\nNOTE: The files in the repo are not organized."
},
{
"author": "ComfyuiGY",
"title": "Comfyui-Memory-Clear",
"reference": "https://github.com/ComfyuiGY/Comfyui-Memory-Clear",
"files": [
"https://github.com/ComfyuiGY/Comfyui-Memory-Clear"
],
"install_type": "git-clone",
"description": "ComfyUI node for clearing memory. (Description by CC)"
},
{
"author": "lying1324a-glitch",
"title": "comfyuiautofirelaod",
@@ -5837,6 +5847,16 @@
"install_type": "git-clone",
"description": "NODES: A custom node for ComfyUI that performs hand detection, implemented with the YOLOv8 model, supporting both hand detection and mask generation."
},
{
"author": "Aero-Ex",
"title": "comfyui_diffswap",
"reference": "https://github.com/Aero-Ex/comfyui_diffswap",
"files": [
"https://github.com/Aero-Ex/comfyui_diffswap"
],
"install_type": "git-clone",
"description": "NODES: DiffSwap"
},
{
"author": "eggsbenedicto",
"title": "DiffusionRenderer-ComfyUI [WIP]",
node_db/dev/extension-node-map.json
+17 -35
View File
@@ -650,6 +650,14 @@
"title_aux": "comfyui-textools [WIP]"
}
],
"https://github.com/Aero-Ex/comfyui_diffswap": [
[
"DiffSwapNode"
],
{
"title_aux": "comfyui_diffswap"
}
],
"https://github.com/Agnuxo1/silicon-comfyui-node": [
[
"SiliconSignatureEmbed",
@@ -4800,6 +4808,14 @@
"title_aux": "ComfyUI-MS-Nodes [WIP]"
}
],
"https://github.com/Sakura-nee/ComfyUI_Save2Discord": [
[
"SendToWebhook"
],
{
"title_aux": "ComfyUI_Save2Discord"
}
],
"https://github.com/SanDiegoDude/ComfyUI-HiDream-Sampler": [
[
"HiDreamImg2Img",
@@ -5284,8 +5300,6 @@
"SDVN Int Slider",
"SDVN Join Parameter",
"SDVN KSampler",
"SDVN LTXAVTextEncoder Download",
"SDVN LatentUpscaleModel Download",
"SDVN Load Checkpoint",
"SDVN Load Checkpoint Filter",
"SDVN Load Google Sheet",
@@ -7399,14 +7413,7 @@
"https://github.com/charlierz/comfyui-charlierz": [
[
"BackgroundColor",
"EstimateTextTokens",
"LlamaCppChat",
"LlamaCppVisionChat",
"PromptHelper",
"PromptHelperFillApply",
"PromptHelperFillRequest",
"ScaleDimensions",
"WildcardProcessor"
"ScaleDimensions"
],
{
"title_aux": "comfyui-charlierz"
@@ -7587,7 +7594,6 @@
"BatchMasksNode",
"BeebleSwitchXImageEdit",
"BeebleSwitchXVideoEdit",
"BerniniConditioning",
"BetaSamplingScheduler",
"BriaImageEditNode",
"BriaRemoveImageBackground",
@@ -7676,10 +7682,6 @@
"CropMask",
"CurveEditor",
"CustomCombo",
"DA3GeometryToMesh",
"DA3GeometryToPointCloud",
"DA3Inference",
"DA3Render",
"DCTestNode",
"DiffControlNetLoader",
"DifferentialDiffusion",
@@ -7899,7 +7901,6 @@
"Load3D",
"LoadAudio",
"LoadBackgroundRemovalModel",
"LoadDA3Model",
"LoadImage",
"LoadImageDataSetFromFolder",
"LoadImageMask",
@@ -8082,9 +8083,6 @@
"Rodin3D_Regular",
"Rodin3D_Sketch",
"Rodin3D_Smooth",
"RunwayAleph2KeyframeNode",
"RunwayAleph2PromptImageNode",
"RunwayAleph2VideoToVideoNode",
"RunwayFirstLastFrameNode",
"RunwayImageToVideoNodeGen3a",
"RunwayImageToVideoNodeGen4",
@@ -8093,7 +8091,6 @@
"SAM3_TrackPreview",
"SAM3_TrackToMask",
"SAM3_VideoTrack",
"SCAIL2ColoredMask",
"SDPoseDrawKeypoints",
"SDPoseFaceBBoxes",
"SDPoseKeypointExtractor",
@@ -8266,7 +8263,6 @@
"TripleCLIPLoader",
"TripoConversionNode",
"TripoImageToModelNode",
"TripoImportModelNode",
"TripoMultiviewToModelNode",
"TripoP1ImageToModelNode",
"TripoP1MultiviewToModelNode",
@@ -12613,7 +12609,6 @@
"LoraStack",
"MergeLoraStacks",
"PipeBase",
"PipeCustom",
"PromptChainer",
"ReplaceTextParameters",
"RerouteBase",
@@ -13403,16 +13398,12 @@
"Add Watermark Image [Eclipse]",
"Any Dual-Switch Purge [Eclipse]",
"Any Dual-Switch [Eclipse]",
"Any Multi-Switch Lazy Purge [Eclipse]",
"Any Multi-Switch Lazy [Eclipse]",
"Any Multi-Switch Purge [Eclipse]",
"Any Multi-Switch [Eclipse]",
"Any Passer Purge [Eclipse]",
"Any Passer [Eclipse]",
"Audio Passer [Eclipse]",
"Basic Pipe Passer [Eclipse]",
"Batch Interleave [Eclipse]",
"Batch Slice [Eclipse]",
"Boolean Passer [Eclipse]",
"Boolean [Eclipse]",
"CLIP Loader [Eclipse]",
@@ -13454,7 +13445,6 @@
"IF A Else B Fallback [Eclipse]",
"IF A Else B [Eclipse]",
"IO Checkpoint Loader [Eclipse]",
"IO Checkpoint Loader v2 [Eclipse]",
"IO Load Image [Eclipse]",
"Image Align Size [Eclipse]",
"Image Batch Extend With Overlap [Eclipse]",
@@ -13467,7 +13457,6 @@
"Image Rescale [Eclipse]",
"Image Resize [Eclipse]",
"Image Resolution [Eclipse]",
"Image Selector [Eclipse]",
"Image Soften [Eclipse]",
"Image Upscale With Model [Eclipse]",
"Image with FX [Eclipse]",
@@ -13479,7 +13468,6 @@
"Keep Calculator [Eclipse]",
"Latent Passer [Eclipse]",
"Load Audio [Eclipse]",
"Load Batch From Folder [Eclipse]",
"Load Directory Settings [Eclipse]",
"Load Image (Metadata Pipe) [Eclipse]",
"Load Image (Pipe) [Eclipse]",
@@ -13574,7 +13562,6 @@
"Smart Loader v2 [Eclipse]",
"Smart Model Loader [Eclipse]",
"Smart Model Loader [SML]",
"Smart Model Loader v2 [Eclipse]",
"Smart Prompt [Eclipse]",
"Smart Prompt v2 [Eclipse]",
"Smart Sampler Settings [Eclipse]",
@@ -13595,13 +13582,11 @@
"UnetLoaderGGUF",
"UnetLoaderGGUFAdvanced",
"Universal Block Swap [Eclipse]",
"VAE Loader Video+Audio [Eclipse]",
"VAE Loader [Eclipse]",
"VAE Passer [Eclipse]",
"VC-Filename Generator I [Eclipse]",
"VC-Filename Generator II [Eclipse]",
"VRAM Cleanup [Eclipse]",
"Video Frame Consistency [Eclipse]",
"Video Resolution [Eclipse]",
"WAN Model Passer [Eclipse]",
"WanVideo Setup [Eclipse]",
@@ -14475,7 +14460,6 @@
"InputText",
"OneMScale",
"ResFinder",
"SDXLResFinder",
"SSchlTextEncoder",
"ShowText",
"Switch",
@@ -14530,7 +14514,6 @@
"JsonPromptToTextPromptConverter",
"JsonSerializeObject",
"LlamaCppTextGenerator",
"LlamaPresetLoader",
"Logger",
"LoraLoaderExtended",
"LoraLoaderExtendedBatch",
@@ -16278,7 +16261,6 @@
"JsonReaderZV",
"JsonToSrtConverterZV",
"LineNumberGeneratorZV",
"LoadAudioFromDirZV",
"LoadImageFromDirZV",
"LoadImageFromUrlZV",
"LoadTxtFromDirZV",
node_db/dev/github-stats.json
+1325 -1310
View File
File diff suppressed because it is too large Load Diff
node_db/legacy/custom-node-list.json
-50
View File
@@ -1,55 +1,5 @@
{
"custom_nodes": [
{
"author": "ComfyuiGY",
"title": "Comfyui-Memory-Clear [REMOVED]",
"reference": "https://github.com/ComfyuiGY/Comfyui-Memory-Clear",
"files": [
"https://github.com/ComfyuiGY/Comfyui-Memory-Clear"
],
"install_type": "git-clone",
"description": "ComfyUI node for clearing memory. (Description by CC)"
},
{
"author": "Draek2077",
"title": "comfyui-draekz-nodez [REMOVED]",
"reference": "https://github.com/Draek2077/comfyui-draekz-nodez",
"files": [
"https://github.com/Draek2077/comfyui-draekz-nodez"
],
"install_type": "git-clone",
"description": "Making ComfyUI more comfortable."
},
{
"author": "amortegui84",
"title": "Tile Upscale NB2 [REMOVED]",
"reference": "https://github.com/amortegui84/comfyui-tile-upscale-nb2",
"files": [
"https://github.com/amortegui84/comfyui-tile-upscale-nb2"
],
"install_type": "git-clone",
"description": "Tile-based upscaling nodes for ComfyUI — Nano Banana 2 compatible"
},
{
"author": "Aero-Ex",
"title": "ComfyUI Vision LLM Analyzer Node [REMOVED]",
"reference": "https://github.com/Aero-Ex/ComfyUI-Vision-LLM-Analyzer",
"files": [
"https://github.com/Aero-Ex/ComfyUI-Vision-LLM-Analyzer"
],
"install_type": "git-clone",
"description": "This repository contains a powerful and versatile custom node for ComfyUI that seamlessly integrates with OpenAI-compatible Large Language Models (LLMs), including multimodal (vision-enabled) models like GPT-4o.\nThis single node allows you to perform both text generation and image analysis, making it an essential tool for advanced prompt engineering and creative automation."
},
{
"author": "Aero-Ex",
"title": "comfyui_diffswap [REMOVED]",
"reference": "https://github.com/Aero-Ex/comfyui_diffswap",
"files": [
"https://github.com/Aero-Ex/comfyui_diffswap"
],
"install_type": "git-clone",
"description": "NODES: DiffSwap"
},
{
"author": "Sakura-nee",
"title": "ComfyUI_Save2Discord [REMOVED]",
node_db/new/custom-node-list.json
-70
View File
@@ -1,75 +1,5 @@
{
"custom_nodes": [
{
"author": "sln77",
"title": "ComfyUI-Tagger",
"reference": "https://github.com/sln77/ComfyUI-Tagger",
"files": [
"https://github.com/sln77/ComfyUI-Tagger"
],
"install_type": "git-clone",
"description": "ComfyUI node integration for the Camie tagger v2 model from Hugging Face for image tagging. (Description by CC)"
},
{
"author": "archerkattri",
"title": "ComfyUI-TRELLIS-HiCache",
"reference": "https://github.com/Archerkattri/ComfyUI-TRELLIS-HiCache",
"files": [
"https://github.com/Archerkattri/ComfyUI-TRELLIS-HiCache"
],
"install_type": "git-clone",
"description": "Training-free TRELLIS image-to-3D acceleration: forecast the flow-matching velocity on skipped DiT steps (HiCache Hermite / HiCache++ DMD, via hicache-pp) across both the sparse-structure and SLaT stages. ~2x faster, near-lossless. Drop between the TRELLIS loader and sampler."
},
{
"author": "shommey",
"title": "LoRA Helpers",
"reference": "https://github.com/shommey/comfyui-lora-helpers",
"files": [
"https://github.com/shommey/comfyui-lora-helpers"
],
"install_type": "git-clone",
"description": "ComfyUI nodes for LoRA training evaluation — XY grid sampling across checkpoints and prompts"
},
{
"author": "wochenlong",
"title": "Anima Edit LoRA",
"reference": "https://github.com/wochenlong/ComfyUI-Anima-Edit-LoRA",
"files": [
"https://github.com/wochenlong/ComfyUI-Anima-Edit-LoRA"
],
"install_type": "git-clone",
"description": "Anima Edit ReferenceLatent compatibility patch for ComfyUI. Lets built-in ReferenceLatent workflows drive single or multiple Anima Edit reference latents."
},
{
"author": "Dragon7108",
"title": "ComfyUI-QuickRatio",
"reference": "https://github.com/Dragon7108/ComfyUI-QuickRatio",
"files": [
"https://github.com/Dragon7108/ComfyUI-QuickRatio"
],
"install_type": "git-clone",
"description": "Aspect-ratio calculator node for ComfyUI — preset + custom ratios, base-resolution scaling, dimensions snapped to multiples of 8, with a live web preview."
},
{
"author": "sparknight",
"title": "ComfyUI-ConditioningMultiplyAdvanced",
"reference": "https://github.com/SparknightLLC/ComfyUI-ConditioningMultiplyAdvanced",
"files": [
"https://github.com/SparknightLLC/ComfyUI-ConditioningMultiplyAdvanced"
],
"install_type": "git-clone",
"description": "Node for scheduling conditioning strength while preserving non-floating tensors such as token ids."
},
{
"author": "wiltodelta",
"title": "Remove AI Watermarks",
"reference": "https://github.com/wiltodelta/ComfyUI-remove-ai-watermarks",
"files": [
"https://github.com/wiltodelta/ComfyUI-remove-ai-watermarks"
],
"install_type": "git-clone",
"description": "Remove visible and invisible AI watermarks (Gemini / Nano Banana, ChatGPT, Stable Diffusion) and erase regions, inside ComfyUI."
},
{
"author": "denyazzolin",
"title": "comfyui-daz-tools",
node_db/new/extension-node-map.json
+126 -481
View File
File diff suppressed because it is too large Load Diff