diff --git a/glob/manager_core.py b/glob/manager_core.py index 7094be6b..515bdcdd 100644 --- a/glob/manager_core.py +++ b/glob/manager_core.py @@ -43,7 +43,7 @@ import manager_downloader from node_package import InstalledNodePackage -version_code = [3, 30, 7] +version_code = [3, 30, 8] version_str = f"V{version_code[0]}.{version_code[1]}" + (f'.{version_code[2]}' if len(version_code) > 2 else '') diff --git a/glob/manager_server.py b/glob/manager_server.py index 3e88850b..6cb81aa2 100644 --- a/glob/manager_server.py +++ b/glob/manager_server.py @@ -273,7 +273,7 @@ import zipfile import urllib.request -def get_model_dir(data, show_log=False): +def get_model_dir(data, show_log=False) -> str | None: if 'download_model_base' in folder_paths.folder_names_and_paths: models_base = folder_paths.folder_names_and_paths['download_model_base'][0][0] else: @@ -281,6 +281,11 @@ def get_model_dir(data, show_log=False): def resolve_custom_node(save_path): save_path = save_path[13:] # remove 'custom_nodes/' + + # NOTE: Validate to prevent path traversal. + if save_path.startswith(os.path.sep) or ':' in save_path: + return None + repo_name = save_path.replace('\\','/').split('/')[0] # get custom node repo name # NOTE: The creation of files within the custom node path should be removed in the future. diff --git a/pyproject.toml b/pyproject.toml index ee2263f6..8f2e56d3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,7 @@ [project] name = "comfyui-manager" description = "ComfyUI-Manager provides features to install and manage custom nodes for ComfyUI, as well as various functionalities to assist with ComfyUI." -version = "3.30.7" +version = "3.30.8" license = { file = "LICENSE.txt" } dependencies = ["GitPython", "PyGithub", "matrix-client==0.4.0", "transformers", "huggingface-hub>0.20", "typer", "rich", "typing-extensions", "toml", "uv", "chardet"]