wangbo/ComfyUI-Manager
1
0
Fork 0
mirror of https://github.com/Comfy-Org/ComfyUI-Manager.git synced 2026-05-08 16:12:35 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity
manager-v4
ComfyUI-Manager/tests
History
Dr.Lt.Data 4410ebc6a6
Some checks are pending
Publish to PyPI / build-and-publish (push) Waiting to run
Details
Python Linting / Run Ruff (push) Waiting to run
Details
fix(security): harden CSRF with Content-Type gate and expand E2E coverage (#2818) 
Defense-in-depth over GET→POST alone: reject the three CORS-safelisted
simple-form Content-Types (x-www-form-urlencoded, multipart/form-data,
text/plain) on 16 no-body POST handlers (glob + legacy) to block
<form method=POST> CSRF that bypasses method-only gating. Move
comfyui_switch_version to a JSON body so the preflight requirement applies.
Split db_mode/policy/update/channel_url_list into GET(read) + POST(write).
Tighten do_fix (high → high+) and gate three previously-ungated config
setters at middle. Resynchronize openapi.yaml (27 paths, 30 operations,
ComfyUISwitchVersionParams as a shared $ref component). Add E2E harness
variants, Playwright config, CSRF/secgate suites, 39-endpoint coverage,
and a CHANGELOG.

Breaking: legacy per-op POST routes (install/uninstall/fix/disable/update/
reinstall/abort_current) are removed; callers already use queue/batch.
Legacy /manager/notice (v1) is removed; /v2/manager/notice is retained.

Reported-by: XlabAI Team of Tencent Xuanwu Lab
CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
2026-04-22 05:04:30 +09:00
..
cli fix(security): harden CSRF with Content-Type gate and expand E2E coverage (#2818) 2026-04-22 05:04:30 +09:00
common fix(git_helper): remove comfyui_manager import to fix Windows subprocess crash (#2703) 2026-03-18 02:04:48 +09:00
e2e fix(security): harden CSRF with Content-Type gate and expand E2E coverage (#2818) 2026-04-22 05:04:30 +09:00
playwright fix(security): harden CSRF with Content-Type gate and expand E2E coverage (#2818) 2026-04-22 05:04:30 +09:00
test_git_compat.py feat: add pygit2 compatibility wrapper for standalone Desktop 2.0 installs (#2719) 2026-03-27 08:42:26 +09:00
test_nightly_cnr_fallback.py feat(cli): expand --uv-compile to all node management commands with conflict attribution (#2682) 2026-03-14 07:58:29 +09:00
test_unified_dep_resolver.py feat(cli): expand --uv-compile to all node management commands with conflict attribution (#2682) 2026-03-14 07:58:29 +09:00