mirror of
https://github.com/comfyanonymous/ComfyUI.git
synced 2026-06-17 21:39:45 +08:00
15d49a61b8
- Disable aiohttp auto-redirects and re-validate every Location target against the same allowlist used for the initial URL, closing an SSRF vector where an allowed host could redirect to an arbitrary internal endpoint. - Accept subdomains of allowlisted hosts so Hugging Face's LFS CDN (cdn-lfs.huggingface.co et al.) keeps working under the stricter redirect handling. - Pass an explicit ClientTimeout (connect/sock_read) so hung remotes surface as errors instead of blocking the request handler forever. - Log the exception value alongside the traceback on the 500 fallback. - Add positive coverage for normalize_model_relative_path, Civitai URL allowlisting, and the redirect-following / SSRF-rejection branches of open_model_download_response. Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|---|---|---|
| .. | ||
| app_test | ||
| assets_test | ||
| comfy_api_test | ||
| comfy_extras_test | ||
| comfy_quant | ||
| comfy_test | ||
| execution_test | ||
| folder_paths_test | ||
| prompt_server_test | ||
| seeder_test | ||
| server/utils | ||
| server_test | ||
| utils | ||
| deploy_environment_test.py | ||
| feature_flags_test.py | ||
| README.md | ||
| requirements.txt | ||
| websocket_feature_flags_test.py | ||
Pytest Unit Tests
Install test dependencies
pip install -r tests-unit/requirements.txt
Run tests
pytest tests-unit/