Merge 2866193baf into ef8703a3d7

- Add is_safe_path_target() and get_safe_file_path() utilities
- Validate history id and snapshot target parameters in API endpoints
- Sanitize config string values to prevent CRLF injection

comfyui_manager/__init__.py

@@ -55,9 +55,10 @@ def should_be_disabled(fullpath:str) -> bool:
 def get_client_ip(request):
     peername = request.transport.get_extra_info("peername")
     if peername is not None:
-        host, port = peername
+        # Grab the first two values - there can be more, ie. with --listen
+        host, port = peername[:2]
         return host
-    
+
     return "unknown"
 
 

comfyui_manager/common/cnr_utils.py

@@ -69,7 +69,10 @@ async def _get_cnr_data(cache_mode=True, dont_wait=True):
                 form_factor = 'git-linux'
             else:
                 form_factor = 'other'
-        
+
+        from comfyui_manager.glob import manager_core
+        verbose = manager_core.get_config().get('verbose', False)
+
         while remained:
             # Add comfyui_version and form_factor to the API request
             sub_uri = f'{base_url}/nodes?page={page}&limit=30&comfyui_version={comfyui_ver}&form_factor={form_factor}'
@@ -79,7 +82,7 @@ async def _get_cnr_data(cache_mode=True, dont_wait=True):
             for x in sub_json_obj['nodes']:
                 full_nodes[x['id']] = x
 
-            if page % 5 == 0:
+            if page % 5 == 0 and verbose:
                 logging.info(f"FETCH ComfyRegistry Data: {page}/{sub_json_obj['totalPages']}")
 
             page += 1

comfyui_manager/common/manager_security.py

@@ -1,4 +1,6 @@
+import os
 from enum import Enum
+from typing import Optional
 
 is_personal_cloud_mode = False
 handler_policy = {}
@@ -34,3 +36,35 @@ def add_handler_policy(x, policy):
     
     
 multiple_remote_alert = do_nothing
+
+
+def is_safe_path_target(target: str) -> bool:
+    """
+    Check if target string is safe from path traversal attacks.
+
+    Args:
+        target: User-provided filename or identifier
+
+    Returns:
+        True if safe, False if contains path traversal characters
+    """
+    if '/' in target or '\\' in target or '..' in target or '\x00' in target:
+        return False
+    return True
+
+
+def get_safe_file_path(target: str, base_dir: str, extension: str = ".json") -> Optional[str]:
+    """
+    Safely construct a file path, preventing path traversal attacks.
+
+    Args:
+        target: User-provided filename (without extension)
+        base_dir: Base directory path
+        extension: File extension to append (default: ".json")
+
+    Returns:
+        Safe file path or None if input contains path traversal attempts
+    """
+    if not is_safe_path_target(target):
+        return None
+    return os.path.join(base_dir, f"{target}{extension}")

comfyui_manager/glob/manager_core.py

@@ -41,13 +41,15 @@ from ..common.enums import NetworkMode, SecurityLevel, DBMode
 from ..common import context
 
 
-version_code = [4, 0, 3]
+version_code = [4, 0, 5]
 version_str = f"V{version_code[0]}.{version_code[1]}" + (f'.{version_code[2]}' if len(version_code) > 2 else '')
 
 
 DEFAULT_CHANNEL = "https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main"
 DEFAULT_CHANNEL_LEGACY = "https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main"
 
+# SSH git URL pattern (e.g., git@github.com:user/repo.git)
+SSH_URL_PATTERN = re.compile(r"^(.+@|ssh://).+:.+$")
 
 default_custom_nodes_path = None
 
@@ -382,16 +384,25 @@ class UnifiedManager:
         self.processed_install = set()
 
     def get_module_name(self, x):
+        # 1. Direct cnr_id lookup
         info = self.active_nodes.get(x)
-        if info is None:
-            # Try to find in unknown_active_nodes by comparing normalized URLs
-            normalized_x = git_utils.normalize_url(x)
-            for url, fullpath in self.unknown_active_nodes.values():
-                if url is not None and git_utils.normalize_url(url) == normalized_x:
-                    return os.path.basename(fullpath)
-        else:
+        if info is not None:
             return os.path.basename(info[1])
 
+        # 2. URL/aux_id → cnr_id conversion via repo_cnr_map
+        cnr_info = self.get_cnr_by_repo(x)
+        if cnr_info is not None:
+            cnr_id = cnr_info['id']
+            info = self.active_nodes.get(cnr_id)
+            if info is not None:
+                return os.path.basename(info[1])
+
+        # 3. Fallback: search unknown_active_nodes by URL
+        normalized_x = git_utils.normalize_url(x)
+        for url, fullpath in self.unknown_active_nodes.values():
+            if url is not None and git_utils.normalize_url(url) == normalized_x:
+                return os.path.basename(fullpath)
+
         return None
 
     def get_cnr_by_repo(self, url):
@@ -1605,8 +1616,14 @@ def write_config():
         'always_lazy_install': get_config()['always_lazy_install'],
         'network_mode': get_config()['network_mode'],
         'db_mode': get_config()['db_mode'],
+        'verbose': get_config()['verbose'],
     }
 
+    # Sanitize all string values to prevent CRLF injection attacks
+    for key, value in config['default'].items():
+        if isinstance(value, str):
+            config['default'][key] = value.replace('\r', '').replace('\n', '').replace('\x00', '')
+
     directory = os.path.dirname(context.manager_config_path)
     if not os.path.exists(directory):
         os.makedirs(directory)
@@ -1644,6 +1661,7 @@ def read_config():
                     'network_mode': default_conf.get('network_mode', NetworkMode.PUBLIC.value).lower(),
                     'security_level': default_conf.get('security_level', SecurityLevel.NORMAL.value).lower(),
                     'db_mode': default_conf.get('db_mode', DBMode.CACHE.value).lower(),
+                    'verbose': get_bool('verbose', False),
                }
 
     except Exception:
@@ -1669,6 +1687,7 @@ def read_config():
             'network_mode': NetworkMode.PUBLIC.value,
             'security_level': SecurityLevel.NORMAL.value,
             'db_mode': DBMode.CACHE.value,
+            'verbose': False,
         }
 
 
@@ -2058,16 +2077,15 @@ class GitProgress(RemoteProgress):
 
 
 def is_valid_url(url):
-    try:
-        # Check for HTTP/HTTPS URL format
-        result = urlparse(url)
-        if all([result.scheme, result.netloc]):
-            return True
-    finally:
-        # Check for SSH git URL format
-        pattern = re.compile(r"^(.+@|ssh://).+:.+$")
-        if pattern.match(url):
-            return True
+    # Check for HTTP/HTTPS URL format
+    result = urlparse(url)
+    if result.scheme and result.netloc:
+        return True
+
+    # Check for SSH git URL format
+    if SSH_URL_PATTERN.match(url):
+        return True
+
     return False
 
 

comfyui_manager/glob/manager_server.py

@@ -1294,11 +1294,17 @@ async def get_history(request):
     try:
         # Handle file-based batch history
         if "id" in request.rel_url.query:
-            json_name = request.rel_url.query["id"] + ".json"
-            batch_path = os.path.join(context.manager_batch_history_path, json_name)
+            history_id = request.rel_url.query["id"]
+
+            # Prevent path traversal attacks
+            batch_path = security_utils.get_safe_file_path(history_id, context.manager_batch_history_path)
+            if batch_path is None:
+                logging.warning(f"[Security] Invalid history id rejected: {history_id}")
+                return web.Response(text="Invalid history id", status=400)
+
             logging.debug(
                 "[ComfyUI-Manager] Fetching batch history: id=%s",
-                request.rel_url.query["id"],
+                history_id,
             )
 
             with open(batch_path, "r", encoding="utf-8") as file:
@@ -1520,7 +1526,11 @@ async def remove_snapshot(request):
     try:
         target = request.rel_url.query["target"]
 
-        path = os.path.join(context.manager_snapshot_path, f"{target}.json")
+        path = security_utils.get_safe_file_path(target, context.manager_snapshot_path)
+        if path is None:
+            logging.warning(f"[Security] Invalid snapshot target rejected: {target}")
+            return web.Response(text="Invalid target", status=400)
+
         if os.path.exists(path):
             os.remove(path)
 
@@ -1538,7 +1548,11 @@ async def restore_snapshot(request):
     try:
         target = request.rel_url.query["target"]
 
-        path = os.path.join(context.manager_snapshot_path, f"{target}.json")
+        path = security_utils.get_safe_file_path(target, context.manager_snapshot_path)
+        if path is None:
+            logging.warning(f"[Security] Invalid snapshot target rejected: {target}")
+            return web.Response(text="Invalid target", status=400)
+
         if os.path.exists(path):
             if not os.path.exists(context.manager_startup_script_path):
                 os.makedirs(context.manager_startup_script_path)

comfyui_manager/glob/utils/security_utils.py

@@ -1,14 +1,14 @@
 from comfyui_manager.glob import manager_core as core
 from comfy.cli_args import args
 from comfyui_manager.data_models import SecurityLevel, RiskLevel, ManagerDatabaseSource
+from comfyui_manager.common.manager_security import (
+    is_loopback,
+    is_safe_path_target,
+    get_safe_file_path,
+)
 
-
-def is_loopback(address):
-    import ipaddress
-    try:
-        return ipaddress.ip_address(address).is_loopback
-    except ValueError:
-        return False
+# Re-export for backward compatibility
+__all__ = ['is_loopback', 'is_safe_path_target', 'get_safe_file_path', 'is_allowed_security_level', 'get_risky_level']
 
 
 def is_allowed_security_level(level):

comfyui_manager/legacy/manager_core.py

@@ -42,13 +42,15 @@ from ..common.enums import NetworkMode, SecurityLevel, DBMode
 from ..common import context
 
 
-version_code = [4, 0, 3]
+version_code = [4, 0, 5]
 version_str = f"V{version_code[0]}.{version_code[1]}" + (f'.{version_code[2]}' if len(version_code) > 2 else '')
 
 
 DEFAULT_CHANNEL = "https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main"
 DEFAULT_CHANNEL_LEGACY = "https://raw.githubusercontent.com/ltdrdata/ComfyUI-Manager/main"
 
+# SSH git URL pattern (e.g., git@github.com:user/repo.git)
+SSH_URL_PATTERN = re.compile(r"^(.+@|ssh://).+:.+$")
 
 default_custom_nodes_path = None
 
@@ -1610,6 +1612,11 @@ def write_config():
         'db_mode': get_config()['db_mode'],
     }
 
+    # Sanitize all string values to prevent CRLF injection attacks
+    for key, value in config['default'].items():
+        if isinstance(value, str):
+            config['default'][key] = value.replace('\r', '').replace('\n', '').replace('\x00', '')
+
     directory = os.path.dirname(context.manager_config_path)
     if not os.path.exists(directory):
         os.makedirs(directory)
@@ -2069,16 +2076,15 @@ class GitProgress(RemoteProgress):
 
 
 def is_valid_url(url):
-    try:
-        # Check for HTTP/HTTPS URL format
-        result = urlparse(url)
-        if all([result.scheme, result.netloc]):
-            return True
-    finally:
-        # Check for SSH git URL format
-        pattern = re.compile(r"^(.+@|ssh://).+:.+$")
-        if pattern.match(url):
-            return True
+    # Check for HTTP/HTTPS URL format
+    result = urlparse(url)
+    if result.scheme and result.netloc:
+        return True
+
+    # Check for SSH git URL format
+    if SSH_URL_PATTERN.match(url):
+        return True
+
     return False
 
 

comfyui_manager/legacy/manager_server.py

@@ -814,8 +814,13 @@ async def get_history_list(request):
 @routes.get("/v2/manager/queue/history")
 async def get_history(request):
     try:
-        json_name = request.rel_url.query["id"]+'.json'
-        batch_path = os.path.join(context.manager_batch_history_path, json_name)
+        history_id = request.rel_url.query["id"]
+
+        # Prevent path traversal attacks
+        batch_path = manager_security.get_safe_file_path(history_id, context.manager_batch_history_path)
+        if batch_path is None:
+            logging.warning(f"[Security] Invalid history id rejected: {history_id}")
+            return web.Response(text="Invalid history id", status=400)
 
         with open(batch_path, 'r', encoding='utf-8') as file:
             json_str = file.read()
@@ -1159,7 +1164,12 @@ async def remove_snapshot(request):
     try:
         target = request.rel_url.query["target"]
 
-        path = os.path.join(context.manager_snapshot_path, f"{target}.json")
+        # Prevent path traversal attacks
+        path = manager_security.get_safe_file_path(target, context.manager_snapshot_path)
+        if path is None:
+            logging.warning(f"[Security] Invalid snapshot target rejected: {target}")
+            return web.Response(text="Invalid target", status=400)
+
         if os.path.exists(path):
             os.remove(path)
 
@@ -1177,7 +1187,12 @@ async def restore_snapshot(request):
     try:
         target = request.rel_url.query["target"]
 
-        path = os.path.join(context.manager_snapshot_path, f"{target}.json")
+        # Prevent path traversal attacks
+        path = manager_security.get_safe_file_path(target, context.manager_snapshot_path)
+        if path is None:
+            logging.warning(f"[Security] Invalid snapshot target rejected: {target}")
+            return web.Response(text="Invalid target", status=400)
+
         if os.path.exists(path):
             if not os.path.exists(context.manager_startup_script_path):
                 os.makedirs(context.manager_startup_script_path)

comfyui_manager/prestartup_script.py

@@ -340,10 +340,13 @@ try:
                 pass
 
             with std_log_lock:
-                if self.is_stdout:
-                    original_stdout.flush()
-                else:
-                    original_stderr.flush()
+                try:
+                    if self.is_stdout:
+                        original_stdout.flush()
+                    else:
+                        original_stderr.flush()
+                except (OSError, ValueError):
+                    pass
 
         def close(self):
             self.flush()

pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "comfyui-manager"
 license = { text = "GPL-3.0-only" }
-version = "4.0.3b7"
+version = "4.0.5"
 requires-python = ">= 3.9"
 description = "ComfyUI-Manager provides features to install and manage custom nodes for ComfyUI, as well as various functionalities to assist with ComfyUI."
 readme = "README.md"