8 Commits

Include renames

Author	SHA1	Message	Date
3 people	412aaab0e2	feat(api): expose registered extension filters on /experiment/models (#14797) ... Each folder in the listing now carries its registered extension allowlist verbatim; an empty array means the folder accepts any extension (match-all), mirroring filter_files_extensions semantics. Gives consumers the filtering rule itself rather than just its output: /models/{folder} lists files by the per-folder rule but the rule is not exposed anywhere, and /experiment/models/{folder} filters everything by the global supported_pt_extensions regardless of registration. Presentation-level filtering of match-all folders (e.g. hiding README/config noise that repository-downloading custom nodes leave in model directories) is deliberately left to the consumer. Co-authored-by: guill <jacob.e.segal@gmail.com>	2026-07-09 12:59:30 -07:00
Matt MillerandGitHub	96e0e3585b	security: fix four vulnerabilities (GHSA-779p-m5rp-r4h4) (#14734) ... * security: fix five vulnerabilities (GHSA-779p-m5rp-r4h4) - CVE-2026-56670: force download of SVG/XML responses on /view to prevent stored XSS - CVE-2026-56671: contain /experiment/models/preview reads within the model folder - CVE-2026-56672: stop inline rendering of uploaded /userdata/{file} content - CVE-2026-56673: prevent path traversal in get_annotated_filepath (LoadImage /prompt input) - CVE-2026-56674: reject opaque/null Origin to close the CSRF middleware bypass Adds regression tests under tests-unit/security_test/ covering all five. * security: address review feedback on GHSA-779p fixes - Fix Windows CI failure in test_get_annotated_filepath: compare against os.path.abspath(...) to match the intentional abspath normalization added by the traversal hardening (abspath prepends the drive letter on Windows). - origin_check: narrow the bare `except:` in is_loopback() to ValueError so genuine interrupts aren't swallowed (review nit). - origin_check: guard .port access in is_cross_origin_forbidden() so a malformed/out-of-range port (e.g. Origin: http://127.0.0.1:99999) fails closed with a 403 instead of surfacing an uncaught 500 in the middleware. - server /view: escape backslash/quote in the Content-Disposition filename (RFC 6266 quoted-string) so a filename containing a double quote can't malform the response header. * security: address CodeRabbit review feedback on GHSA-779p tests - test #3: guard the symlink-escape test with a try/except skip so it no longer errors on Windows CI where os.symlink needs elevated privileges / Developer Mode (mirrors the guard in the sibling test #2). - test #5: refresh the stale module docstring to describe the actual /view gating (view_image closure calling folder_paths.is_dangerous_content_type, the normalising check) instead of the bypassable raw set-membership test. * revert(security): drop CVE-2026-56674 Origin: null CSRF change Per maintainer review, the reported CSRF is already mitigated by the pre-existing Sec-Fetch-Site: cross-site check for current browsers, and the null-origin rejection risked breaking legitimate sandboxed-iframe embeds. Restores origin_only_middleware and is_loopback in server.py to their prior state (the Sec-Fetch-Site check is retained) and removes utils/origin_check.py and its regression test. The other four GHSA-779p fixes are unaffected.	2026-07-02 20:44:54 -07:00
comfyanonymousandGitHub	da49b7d0b6	Remove useless annotations imports. (#14105)	2026-05-25 19:23:29 -07:00
comfyanonymousandGitHub	65cfcf5b1b	New Year ruff cleanup. (#11595)	2026-01-01 22:06:14 -05:00
Johnpaul ChiweteluandGitHub	3dfefc88d0	API for Recently Used Items (#8792) ... * feat: add file creation time to model file metadata and user file info * fix linting	2025-08-01 22:02:06 -04:00
comfyanonymous	b504bd606d	Add ruff rule for empty line with trailing whitespace.	2024-12-28 05:23:08 -05:00
catboxanonandGitHub	3cacd3fca5	Support preview images embedded in safetensors metadata (#6119) ... * Support preview images embedded in safetensors metadata * Add unit test for safetensors embedded image previews	2024-12-19 14:01:56 -08:00
HaydenandGitHub	5747bc6457	Optimize model library (#5841) ... * Move model manager routes * Add experiment model manager api * Fix cache causing returns to be empty * Fix unable to compare sub-dir caches * Skip non-existent folders * Add model preview * Revert 'Move model manager routes' * move model_filemanager.py to app/ * Update model_manager.py 3.8 compatibility ---------	2024-12-11 18:12:04 -05:00