From dd9f4d1a323def1ee682aec42ad1e19ca526d8ba Mon Sep 17 00:00:00 2001 From: Varun Chawla Date: Sat, 7 Feb 2026 15:28:39 -0800 Subject: [PATCH 1/3] security: refine path traversal validation to allow consecutive dots in filenames Fixes #12352 The previous validation incorrectly rejected filenames with consecutive dots (e.g., test..png) by checking if '..' exists anywhere in the filename. This commit refines the validation to: - Block actual path traversal patterns: '../', '/..' - Block filenames starting with '..' (e.g., '..secret') - Block absolute paths starting with '/' - Allow consecutive dots in filenames (e.g., 'test..png', 'my...file.jpg') Changes: - Updated validation logic in /view and /upload/mask endpoints - Added comprehensive test suite covering both security and functionality - All tests pass: blocks path traversal, allows valid filenames with dots --- server.py | 6 +- tests-unit/server_test/test_view_endpoint.py | 114 +++++++++++++++++++ 2 files changed, 118 insertions(+), 2 deletions(-) create mode 100644 tests-unit/server_test/test_view_endpoint.py diff --git a/server.py b/server.py index 275bce5a7..d606bb97c 100644 --- a/server.py +++ b/server.py @@ -441,7 +441,8 @@ class PromptServer(): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - if filename[0] == '/' or '..' in filename: + # Check for path traversal patterns (../ or /..) but allow consecutive dots in filename + if filename[0] == '/' or '/..' in filename or filename.startswith('..'): return web.Response(status=400) if output_dir is None: @@ -485,7 +486,8 @@ class PromptServer(): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - if filename[0] == '/' or '..' in filename: + # Check for path traversal patterns (../ or /..) but allow consecutive dots in filename + if filename[0] == '/' or '/..' in filename or filename.startswith('..'): return web.Response(status=400) if output_dir is None: diff --git a/tests-unit/server_test/test_view_endpoint.py b/tests-unit/server_test/test_view_endpoint.py new file mode 100644 index 000000000..19d156233 --- /dev/null +++ b/tests-unit/server_test/test_view_endpoint.py @@ -0,0 +1,114 @@ +"""Tests for /view endpoint path traversal validation""" + +import pytest +from aiohttp import web +from aiohttp.test_utils import AioHTTPTestCase, unittest_run_loop +import os +import tempfile +from pathlib import Path + + +class TestViewEndpointSecurity(AioHTTPTestCase): + """Test /view endpoint path traversal validation""" + + async def get_application(self): + """Create a minimal test application with /view endpoint""" + app = web.Application() + + # Create a test directory with test files + self.test_dir = tempfile.mkdtemp() + self.test_file_valid = os.path.join(self.test_dir, "test..png") + self.test_file_normal = os.path.join(self.test_dir, "normal.png") + + # Create test files + Path(self.test_file_valid).touch() + Path(self.test_file_normal).touch() + + async def view_handler(request): + """Simplified /view endpoint handler for testing""" + if "filename" not in request.rel_url.query: + return web.Response(status=404) + + filename = request.rel_url.query["filename"] + + if not filename: + return web.Response(status=400) + + # validation for security: prevent accessing arbitrary path + # Check for path traversal patterns (../ or /..) but allow consecutive dots in filename + if filename[0] == '/' or '/..' in filename or filename.startswith('..'): + return web.Response(status=400) + + # For testing, just check if file exists in test directory + filename = os.path.basename(filename) + file_path = os.path.join(self.test_dir, filename) + + if os.path.isfile(file_path): + return web.Response(status=200, text="OK") + + return web.Response(status=404) + + app.router.add_get('/view', view_handler) + return app + + async def tearDownAsync(self): + """Clean up test files""" + import shutil + if hasattr(self, 'test_dir') and os.path.exists(self.test_dir): + shutil.rmtree(self.test_dir) + + @unittest_run_loop + async def test_allows_consecutive_dots_in_filename(self): + """Test that files with consecutive dots (e.g., test..png) are allowed""" + resp = await self.client.request("GET", "/view?filename=test..png") + assert resp.status == 200, "Should allow files with consecutive dots in filename" + + @unittest_run_loop + async def test_allows_normal_filenames(self): + """Test that normal filenames work""" + resp = await self.client.request("GET", "/view?filename=normal.png") + assert resp.status == 200, "Should allow normal filenames" + + @unittest_run_loop + async def test_blocks_path_traversal_dotdot_slash(self): + """Test that path traversal with ../ is blocked""" + resp = await self.client.request("GET", "/view?filename=../etc/passwd") + assert resp.status == 400, "Should block ../ path traversal" + + @unittest_run_loop + async def test_blocks_path_traversal_slash_dotdot(self): + """Test that path traversal with /.. is blocked""" + resp = await self.client.request("GET", "/view?filename=folder/../etc/passwd") + assert resp.status == 400, "Should block /.. path traversal" + + @unittest_run_loop + async def test_blocks_absolute_paths(self): + """Test that absolute paths starting with / are blocked""" + resp = await self.client.request("GET", "/view?filename=/etc/passwd") + assert resp.status == 400, "Should block absolute paths" + + @unittest_run_loop + async def test_blocks_dotdot_at_start(self): + """Test that filenames starting with .. are blocked""" + resp = await self.client.request("GET", "/view?filename=..secret") + assert resp.status == 400, "Should block filenames starting with .." + + @unittest_run_loop + async def test_multiple_consecutive_dots(self): + """Test that multiple consecutive dots in filename are allowed""" + # Create a file with multiple dots + test_file = os.path.join(self.test_dir, "test...png") + Path(test_file).touch() + + resp = await self.client.request("GET", "/view?filename=test...png") + assert resp.status == 200, "Should allow files with multiple consecutive dots" + + @unittest_run_loop + async def test_dots_in_middle_of_filename(self): + """Test that dots in the middle of filename are allowed""" + # Create a file with dots in middle + test_file = os.path.join(self.test_dir, "my..file..name.png") + Path(test_file).touch() + + resp = await self.client.request("GET", "/view?filename=my..file..name.png") + assert resp.status == 200, "Should allow dots in middle of filename" From ae575a86702a3c217104ce7ffe25bbd0c1a92b36 Mon Sep 17 00:00:00 2001 From: Varun Chawla Date: Sun, 8 Feb 2026 19:27:53 -0800 Subject: [PATCH 2/3] security: handle Windows backslash path traversal in filename validation Normalize backslashes to forward slashes before checking for path traversal patterns, preventing attacks like `folder\..\secret` that bypass forward-slash-only checks on Windows. Addresses review feedback from light-and-ray on PR #12353. Co-Authored-By: Claude Opus 4.6 --- server.py | 10 ++++--- tests-unit/server_test/test_view_endpoint.py | 29 ++++++++++++++++++-- 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/server.py b/server.py index d606bb97c..f49d9e604 100644 --- a/server.py +++ b/server.py @@ -441,8 +441,9 @@ class PromptServer(): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - # Check for path traversal patterns (../ or /..) but allow consecutive dots in filename - if filename[0] == '/' or '/..' in filename or filename.startswith('..'): + # Normalize backslashes to forward slashes to handle Windows-style path traversal (e.g., folder\..\secret) + normalized = filename.replace('\\', '/') + if normalized[0] == '/' or '/..' in normalized or normalized.startswith('..'): return web.Response(status=400) if output_dir is None: @@ -486,8 +487,9 @@ class PromptServer(): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - # Check for path traversal patterns (../ or /..) but allow consecutive dots in filename - if filename[0] == '/' or '/..' in filename or filename.startswith('..'): + # Normalize backslashes to forward slashes to handle Windows-style path traversal (e.g., folder\..\secret) + normalized = filename.replace('\\', '/') + if normalized[0] == '/' or '/..' in normalized or normalized.startswith('..'): return web.Response(status=400) if output_dir is None: diff --git a/tests-unit/server_test/test_view_endpoint.py b/tests-unit/server_test/test_view_endpoint.py index 19d156233..1f7ca083c 100644 --- a/tests-unit/server_test/test_view_endpoint.py +++ b/tests-unit/server_test/test_view_endpoint.py @@ -35,8 +35,9 @@ class TestViewEndpointSecurity(AioHTTPTestCase): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - # Check for path traversal patterns (../ or /..) but allow consecutive dots in filename - if filename[0] == '/' or '/..' in filename or filename.startswith('..'): + # Normalize backslashes to forward slashes to handle Windows-style path traversal + normalized = filename.replace('\\', '/') + if normalized[0] == '/' or '/..' in normalized or normalized.startswith('..'): return web.Response(status=400) # For testing, just check if file exists in test directory @@ -112,3 +113,27 @@ class TestViewEndpointSecurity(AioHTTPTestCase): resp = await self.client.request("GET", "/view?filename=my..file..name.png") assert resp.status == 200, "Should allow dots in middle of filename" + + @unittest_run_loop + async def test_blocks_backslash_path_traversal(self): + """Test that Windows-style backslash path traversal (\\..) is blocked""" + resp = await self.client.request("GET", "/view?filename=folder%5C..%5Csecret") + assert resp.status == 400, "Should block backslash path traversal" + + @unittest_run_loop + async def test_blocks_backslash_dotdot_at_start(self): + """Test that backslash path traversal starting with ..\\ is blocked""" + resp = await self.client.request("GET", "/view?filename=..%5Cetc%5Cpasswd") + assert resp.status == 400, "Should block ..\\ path traversal at start" + + @unittest_run_loop + async def test_blocks_mixed_slash_backslash_traversal(self): + """Test that mixed forward/backslash path traversal is blocked""" + resp = await self.client.request("GET", "/view?filename=folder/..%5Csecret") + assert resp.status == 400, "Should block mixed slash/backslash path traversal" + + @unittest_run_loop + async def test_blocks_backslash_absolute_path(self): + """Test that Windows absolute paths with backslash are blocked (e.g., C:\\)""" + resp = await self.client.request("GET", "/view?filename=%5Cetc%5Cpasswd") + assert resp.status == 400, "Should block backslash absolute paths" From ab484ef4e6fa66c9e84275d732376cd04e47b8a8 Mon Sep 17 00:00:00 2001 From: Varun Chawla Date: Tue, 10 Feb 2026 02:50:45 -0800 Subject: [PATCH 3/3] refactor: use PurePosixPath for path traversal validation per review feedback --- server.py | 11 ++++++---- tests-unit/server_test/test_view_endpoint.py | 21 ++++++++++++++------ 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/server.py b/server.py index f49d9e604..ec442bf8b 100644 --- a/server.py +++ b/server.py @@ -3,6 +3,7 @@ import sys import asyncio import traceback import time +from pathlib import PurePosixPath import nodes import folder_paths @@ -441,9 +442,10 @@ class PromptServer(): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - # Normalize backslashes to forward slashes to handle Windows-style path traversal (e.g., folder\..\secret) + # Normalize backslashes and use standard library to parse path components normalized = filename.replace('\\', '/') - if normalized[0] == '/' or '/..' in normalized or normalized.startswith('..'): + path = PurePosixPath(normalized) + if path.is_absolute() or '..' in path.parts: return web.Response(status=400) if output_dir is None: @@ -487,9 +489,10 @@ class PromptServer(): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - # Normalize backslashes to forward slashes to handle Windows-style path traversal (e.g., folder\..\secret) + # Normalize backslashes and use standard library to parse path components normalized = filename.replace('\\', '/') - if normalized[0] == '/' or '/..' in normalized or normalized.startswith('..'): + path = PurePosixPath(normalized) + if path.is_absolute() or '..' in path.parts: return web.Response(status=400) if output_dir is None: diff --git a/tests-unit/server_test/test_view_endpoint.py b/tests-unit/server_test/test_view_endpoint.py index 1f7ca083c..622d96003 100644 --- a/tests-unit/server_test/test_view_endpoint.py +++ b/tests-unit/server_test/test_view_endpoint.py @@ -5,7 +5,7 @@ from aiohttp import web from aiohttp.test_utils import AioHTTPTestCase, unittest_run_loop import os import tempfile -from pathlib import Path +from pathlib import Path, PurePosixPath class TestViewEndpointSecurity(AioHTTPTestCase): @@ -19,10 +19,12 @@ class TestViewEndpointSecurity(AioHTTPTestCase): self.test_dir = tempfile.mkdtemp() self.test_file_valid = os.path.join(self.test_dir, "test..png") self.test_file_normal = os.path.join(self.test_dir, "normal.png") + self.test_file_dotsecret = os.path.join(self.test_dir, "..secret") # Create test files Path(self.test_file_valid).touch() Path(self.test_file_normal).touch() + Path(self.test_file_dotsecret).touch() async def view_handler(request): """Simplified /view endpoint handler for testing""" @@ -35,9 +37,10 @@ class TestViewEndpointSecurity(AioHTTPTestCase): return web.Response(status=400) # validation for security: prevent accessing arbitrary path - # Normalize backslashes to forward slashes to handle Windows-style path traversal + # Normalize backslashes and use standard library to parse path components normalized = filename.replace('\\', '/') - if normalized[0] == '/' or '/..' in normalized or normalized.startswith('..'): + path = PurePosixPath(normalized) + if path.is_absolute() or '..' in path.parts: return web.Response(status=400) # For testing, just check if file exists in test directory @@ -89,10 +92,16 @@ class TestViewEndpointSecurity(AioHTTPTestCase): assert resp.status == 400, "Should block absolute paths" @unittest_run_loop - async def test_blocks_dotdot_at_start(self): - """Test that filenames starting with .. are blocked""" + async def test_allows_dotdot_prefix_in_filename(self): + """Test that filenames starting with .. but not as a path component are allowed""" resp = await self.client.request("GET", "/view?filename=..secret") - assert resp.status == 400, "Should block filenames starting with .." + assert resp.status == 200, "Should allow filenames starting with .. that aren't path traversal" + + @unittest_run_loop + async def test_blocks_bare_dotdot(self): + """Test that bare .. as a path component is blocked""" + resp = await self.client.request("GET", "/view?filename=..") + assert resp.status == 400, "Should block bare .. path component" @unittest_run_loop async def test_multiple_consecutive_dots(self):