ComfyUI/comfy_execution
Matt Miller f91e3416b6 fix(assets): reject path traversal when resolving output abs_path
Subfolder/filename were joined and absolutized without containment check,
so '..' segments or an absolute filename could escape the type's base
directory and register an unrelated on-disk file as an asset.

Add commonpath-based containment check; skip enrichment (warn, leave
entry unchanged) when the resolved path escapes base. Catches ValueError
from cross-drive paths on Windows.
2026-05-20 11:06:38 -07:00
..
asset_enrichment.py fix(assets): reject path traversal when resolving output abs_path 2026-05-20 11:06:38 -07:00
cache_provider.py Revert "Revert "feat: Add CacheProvider API for external distributed caching"" (#12915) 2026-03-12 21:17:50 -07:00
caching.py dynamicVRAM + --cache-ram 2 (CORE-117) (#13603) 2026-04-28 19:15:02 -04:00
graph_utils.py V3 Node Schema Definition - initial (#8656) 2025-07-31 18:02:12 -04:00
graph.py Revert "Revert "feat: Add CacheProvider API for external distributed caching"" (#12915) 2026-03-12 21:17:50 -07:00
jobs.py Revert "Include workflow_id in all execution WebSocket messages (CORE-198) (#…" (#13901) 2026-05-14 15:35:42 -07:00
progress.py Revert "Include workflow_id in all execution WebSocket messages (CORE-198) (#…" (#13901) 2026-05-14 15:35:42 -07:00
utils.py Support for async node functions (#8830) 2025-07-10 14:46:19 -04:00
validation.py V3 Improvements + DynamicCombo + Autogrow exposed in public API (#11345) 2025-12-30 23:09:55 -05:00