diff --git a/glob/security_check.py b/glob/security_check.py new file mode 100644 index 00000000..25632110 --- /dev/null +++ b/glob/security_check.py @@ -0,0 +1,52 @@ +import sys +import subprocess +import os + + +def security_check(): + print("[START] Security scan") + + custom_nodes_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..')) + + guide = {"ComfyUI_LLMVISION": """ +1.Remove pip packages: openai-1.16.3.dist-info, anthropic-0.21.4.dist-info, openai-1.30.2.dist-info, anthropic-0.26.1.dist-info +2.Remove these files in your system: lib/browser/admin.py, Cadmino.py, Fadmino.py, VISION-D.exe +3.Check your Windows registry for the key listed above and remove it. +4.Change all of your passwords, everywhere. + """} + + node_blacklist = {"ComfyUI_LLMVISION": "ComfyUI_LLMVISION"} + + pip_blacklist = {"AppleBotzz": "ComfyUI_LLMVISION"} + + installed_pips = subprocess.check_output([sys.executable, '-m', "pip", "freeze"], text=True) + + detected = set() + for k, v in node_blacklist.items(): + if os.path.exists(os.path.join(custom_nodes_path, k)): + print(f"[SECURITY ALERT] custom node '{k}' is dangerous.") + detected.add(v) + + for k, v in pip_blacklist.items(): + if k in installed_pips: + detected.add(v) + break + + if len(detected) > 0: + for line in installed_pips.split('\n'): + for k, v in pip_blacklist.items(): + if k in line: + print(f"[SECURITY ALERT] '{line}' is dangerous.") + + print("\n########################################################################") + print(" Malware has been detected, forcibly terminating ComfyUI execution.") + print("########################################################################\n") + + for x in detected: + print(f"\n======== TARGET: {x} =========") + print(f"\nTODO:") + print(guide[x]) + + exit(-1) + + print("[DONE] Security scan") diff --git a/prestartup_script.py b/prestartup_script.py index a5f28a9e..943f771c 100644 --- a/prestartup_script.py +++ b/prestartup_script.py @@ -9,13 +9,14 @@ import locale import platform import json - glob_path = os.path.join(os.path.dirname(__file__), "glob") sys.path.append(glob_path) +import security_check from manager_util import * import cm_global +security_check.security_check() cm_global.pip_downgrade_blacklist = ['torch', 'torchsde', 'torchvision', 'transformers', 'safetensors', 'kornia']