wangbo/ComfyUI
1
0
Fork 0
mirror of https://github.com/comfyanonymous/ComfyUI.git synced 2026-06-22 07:49:33 +08:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Reject Windows subfolder paths

Browse Source 
Amp-Thread-ID: https://ampcode.com/threads/T-019ecf39-2e6f-747d-ae80-addba6b8e4f5
Co-authored-by: Amp <amp@ampcode.com>
This commit is contained in:
Simon Pinfold 2026-06-18 16:44:48 +12:00
parent 2d46d9241e
commit 54d64d9762
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/assets/services/path_utils.py
View File

@ -1,5 +1,5 @@
import os import os
from pathlib import Path from pathlib import Path, PureWindowsPath
from typing import Literal from typing import Literal
import folder_paths import folder_paths
@ -29,6 +29,12 @@ def _validate_subfolder(subfolder: str | None) -> list[str]:
if not subfolder: if not subfolder:
return [] return []
if "\\" in subfolder:
raise ValueError("invalid subfolder path")
windows_path = PureWindowsPath(subfolder)
if windows_path.drive or windows_path.root:
raise ValueError("invalid subfolder path")
parts = Path(subfolder).parts parts = Path(subfolder).parts
invalid = {"", ".", ".."} invalid = {"", ".", ".."}
if Path(subfolder).is_absolute() or any(part in invalid for part in parts): if Path(subfolder).is_absolute() or any(part in invalid for part in parts):

5
tests-unit/assets_test/services/test_path_utils.py
View File

@ -179,7 +179,10 @@ class TestResolveDestinationFromTags:
assert base_dir == os.path.abspath(fake_dirs["input"]) assert base_dir == os.path.abspath(fake_dirs["input"])
assert subdirs == ["foo", "bar"] assert subdirs == ["foo", "bar"]
@pytest.mark.parametrize("subfolder", ["../escape", "foo/../bar", "/abs", "foo\\bar"]) @pytest.mark.parametrize(
"subfolder",
["../escape", "foo/../bar", "/abs", "foo\\bar", "C:/escape", "C:escape"],
)
def test_explicit_subfolder_rejects_unsafe_paths(self, fake_dirs, subfolder: str): def test_explicit_subfolder_rejects_unsafe_paths(self, fake_dirs, subfolder: str):
with pytest.raises(ValueError, match="invalid subfolder"): with pytest.raises(ValueError, match="invalid subfolder"):
resolve_destination_from_tags(["input", "unit-tests"], subfolder=subfolder) resolve_destination_from_tags(["input", "unit-tests"], subfolder=subfolder)