mirror of
https://github.com/Comfy-Org/ComfyUI-Manager.git
synced 2026-05-09 16:42:32 +08:00
491f847bbc
Some checks failed
Python Linting / Run Ruff (push) Has been cancelled
Defense-in-depth over GET→POST alone: reject the three CORS-safelisted
simple-form Content-Types (x-www-form-urlencoded, multipart/form-data,
text/plain) on 5 no-body POST handlers (snapshot/save,
manager/queue/{reset,start,update_comfyui}, manager/reboot) to block
<form method=POST> CSRF that bypasses method-only gating. Convert 10 pure
state-changing endpoints (fetch_updates, queue/{update_all,reset,start,
update_comfyui}, snapshot/{remove,restore,save}, comfyui_switch_version,
reboot) from GET to POST and split 5 config endpoints
(db_mode/preview_method/channel_url_list/policy/{component,update}) into
GET(read) + POST(write, JSON body). Emit the in_progress + done event pair
from the /manager/queue/install sync-enable fast-path so client UI
finalizes (previously only queue/start's empty worker done fired, leaving
item.restart unset and the Enable button visible after a successful enable).
Harden js/custom-nodes-manager.js completion path: await onQueueCompleted
with try/catch (surfaces silent turbogrid stale-item throws), replace the
{}.length == 0 no-op empty guard, set install_context before queue/install
to avoid a sync-completion race, wrap classList/updateCell in try/catch.
Resynchronize openapi.yaml with the converted routes (method → post, query
params → requestBody JSON schema, sibling post on 5 split endpoints).
Update 31 JS fetchApi call sites across 7 files; add
tests/test_csrf_content_type_helper.py covering 5 Content-Type cases via
aiohttp TestClient.
Reported-by: XlabAI Team of Tencent Xuanwu Lab
CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
|
||
|---|---|---|
| .. | ||
| cm-api.js | ||
| comfyui-gui-builder.js | ||
| comfyui-manager.js | ||
| comfyui-share-common.js | ||
| comfyui-share-copus.js | ||
| comfyui-share-openart.js | ||
| comfyui-share-youml.js | ||
| common.js | ||
| components-manager.js | ||
| custom-nodes-manager.css | ||
| custom-nodes-manager.js | ||
| model-manager.css | ||
| model-manager.js | ||
| node_fixer.js | ||
| popover-helper.js | ||
| README.md | ||
| snapshot.css | ||
| snapshot.js | ||
| turbogrid.esm.js | ||
| workflow-metadata.js | ||
ComfyUI-Manager: Frontend (js)
This directory contains the JavaScript frontend implementation for ComfyUI-Manager, providing the user interface components that interact with the backend API.
Core Components
- comfyui-manager.js: Main entry point that initializes the manager UI and integrates with ComfyUI.
- custom-nodes-manager.js: Implements the UI for browsing, installing, and managing custom nodes.
- model-manager.js: Handles the model management interface for downloading and organizing AI models.
- components-manager.js: Manages reusable workflow components system.
- snapshot.js: Implements the snapshot system for backing up and restoring installations.
Sharing Components
- comfyui-share-common.js: Base functionality for workflow sharing features.
- comfyui-share-copus.js: Integration with the ComfyUI Copus sharing platform.
- comfyui-share-openart.js: Integration with the OpenArt sharing platform.
- comfyui-share-youml.js: Integration with the YouML sharing platform.
Utility Components
- cm-api.js: Client-side API wrapper for communication with the backend.
- common.js: Shared utilities and helper functions used across the frontend.
- node_fixer.js: Utilities for fixing disconnected links and repairing malformed nodes by recreating them while preserving connections.
- popover-helper.js: UI component for popup tooltips and contextual information.
- turbogrid.esm.js: Grid component library - https://github.com/cenfun/turbogrid
- workflow-metadata.js: Handles workflow metadata parsing, validation and cross-repository compatibility including versioning, dependencies tracking, and resource management.
Architecture
The frontend follows a modular component-based architecture:
- Integration Layer: Connects with ComfyUI's existing UI system
- Manager Components: Individual functional UI components (node manager, model manager, etc.)
- Sharing Components: Platform-specific sharing implementations
- Utility Layer: Reusable UI components and helpers
Implementation Details
- The frontend integrates directly with ComfyUI's UI system through
app.js - Dialog-based UI for most manager functions to avoid cluttering the main interface
- Asynchronous API calls to handle backend operations without blocking the UI
Styling
CSS files are included for specific components:
- custom-nodes-manager.css: Styling for the node management UI
- model-manager.css: Styling for the model management UI
This frontend implementation provides a comprehensive yet user-friendly interface for managing the ComfyUI ecosystem.