wangbo/ComfyUI
1
0
Fork 0
mirror of https://github.com/comfyanonymous/ComfyUI.git synced 2026-03-16 14:47:33 +08:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Remove mime_type from asset update API

Browse Source 
Clients can no longer modify mime_type after asset creation via the
PUT /api/assets/{id} endpoint. This reduces the risk of mime_type
spoofing. The internal update_asset_hash_and_mime function remains
available for server-side use (e.g., enrichment).

Amp-Thread-ID: https://ampcode.com/threads/T-019cef5d-8d61-75cc-a1c6-2841ac395648
Co-authored-by: Amp <amp@ampcode.com>
This commit is contained in:
Luke Mino-Altherr 2026-03-14 22:46:14 -04:00
parent ecc20c9a27
commit a8d524a022
2 changed files with 2 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app/assets/api/routes.py
View File

@ -494,7 +494,6 @@ async def update_asset_route(request: web.Request) -> web.Response:
name=body.name, name=body.name,
user_metadata=body.user_metadata, user_metadata=body.user_metadata,
owner_id=USER_MANAGER.get_request_user_id(request), owner_id=USER_MANAGER.get_request_user_id(request),
mime_type=body.mime_type,
preview_id=body.preview_id, preview_id=body.preview_id,
) )
payload = _build_asset_response(result) payload = _build_asset_response(result)

5
app/assets/api/schemas_in.py
View File

@ -100,17 +100,16 @@ class ListAssetsQuery(BaseModel):
class UpdateAssetBody(BaseModel): class UpdateAssetBody(BaseModel):
name: str | None = None name: str | None = None
user_metadata: dict[str, Any] | None = None user_metadata: dict[str, Any] | None = None
mime_type: str | None = None
preview_id: str | None = None # references an asset_reference id, not an asset id preview_id: str | None = None # references an asset_reference id, not an asset id
@model_validator(mode="after") @model_validator(mode="after")
def _validate_at_least_one_field(self): def _validate_at_least_one_field(self):
if all( if all(
v is None v is None
for v in (self.name, self.user_metadata, self.mime_type, self.preview_id) for v in (self.name, self.user_metadata, self.preview_id)
): ):
raise ValueError( raise ValueError(
"Provide at least one of: name, user_metadata, mime_type, preview_id." "Provide at least one of: name, user_metadata, preview_id."
) )
return self return self