qnloft
/
ComfyUI
mirror of https://github.com/comfyanonymous/ComfyUI.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix path traversal for /view

This commit is contained in:
m957ymj75urz 2023-03-14 09:27:17 +01:00
parent 5b425aaa40
commit b1294fa49f
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
server.py
View File

@ -118,11 +118,15 @@ class PromptServer():
output_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), type) output_dir = os.path.join(os.path.dirname(os.path.realpath(__file__)), type)
if "subfolder" in request.rel_url.query: if "subfolder" in request.rel_url.query:
output_dir = os.path.join(output_dir, request.rel_url.query["subfolder"]) full_output_dir = os.path.join(output_dir, request.rel_url.query["subfolder"])
if os.path.commonpath((os.path.realpath(full_output_dir), output_dir)) != output_dir:
return web.Response(status=403)
output_dir = full_output_dir
file = request.rel_url.query["file"] file = request.rel_url.query["file"]
file = os.path.basename(file) file = os.path.basename(file)
file = os.path.join(output_dir, file) file = os.path.join(output_dir, file)
if os.path.isfile(file): if os.path.isfile(file):
return web.FileResponse(file) return web.FileResponse(file)