wangbo/ComfyUI
1
0
Fork 0
mirror of https://github.com/comfyanonymous/ComfyUI.git synced 2026-07-06 22:51:18 +08:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Merge cf43a3a63e into b08debceca

Browse Source
This commit is contained in:
Jake Lodwick 2026-07-06 17:34:10 +08:00 committed by GitHub
commit fff1cb0d2c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
comfy_extras/nodes_dataset.py
View File

@ -1556,7 +1556,13 @@ class LoadTrainingDataset(io.ComfyNode):
@classmethod
def execute(cls, folder_name):
# Get dataset directory
dataset_dir = os.path.join(folder_paths.get_output_directory(), folder_name)
output_dir = folder_paths.get_output_directory()
dataset_dir = os.path.join(output_dir, folder_name)
# Prevent path traversal (e.g. folder_name="../../etc")
real_output_dir = os.path.realpath(output_dir)
real_dataset_dir = os.path.realpath(dataset_dir)
if os.path.commonpath((real_output_dir, real_dataset_dir)) != real_output_dir:
raise ValueError(f"Invalid folder_name: path traversal detected")
if not os.path.exists(dataset_dir):
raise ValueError(f"Dataset directory not found: {dataset_dir}")