alphard/ComfyUI-Lora-Manager
1
0
Fork 0
mirror of https://github.com/willmiao/ComfyUI-Lora-Manager.git synced 2026-08-06 14:10:13 -03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): use abspath instead of realpath in containment checks to support symlinks (#1028)

Browse Source
This commit is contained in:
Will Miao
2026-07-23 07:06:41 +08:00
parent fe95fae5f2
commit 7c8dc57d55
5 changed files with 78 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
py/services/download_manager.py
View File

@@ -1392,8 +1392,8 @@ class DownloadManager:
base_save_dir = save_dir
save_dir = os.path.join(save_dir, relative_path)
# Security: validate path containment after joining
resolved_dir = os.path.realpath(os.path.normpath(save_dir))
base_dir = os.path.realpath(os.path.normpath(base_save_dir))
resolved_dir = os.path.abspath(os.path.normpath(save_dir))
base_dir = os.path.abspath(os.path.normpath(base_save_dir))
if not resolved_dir.startswith(base_dir + os.sep) and resolved_dir != base_dir:
logger.warning(
"Path traversal detected: %s escapes %s",

11
py/services/model_lifecycle_service.py
View File

@@ -51,9 +51,10 @@ async def delete_model_artifacts(
def _require_path_in_library_roots(file_path: str, scanner, *, label: str = "path") -> None:
"""Raise ``ValueError`` if *file_path* is not inside a configured model root.
Uses ``os.path.realpath()`` to resolve symlinks before comparing,
so symlink-based escapes are also caught. Skips when the scanner
does not expose ``get_model_roots`` or the list is empty.
Uses ``os.path.abspath()`` (NOT ``realpath``) to resolve ``..`` and ``.``
while preserving symlinks — this keeps the check in business-path space.
Skips when the scanner does not expose ``get_model_roots`` or the list
is empty.
"""
roots = None
@@ -65,10 +66,10 @@ def _require_path_in_library_roots(file_path: str, scanner, *, label: str = "pat
if not roots:
return
resolved = os.path.realpath(os.path.normpath(file_path))
resolved = os.path.abspath(os.path.normpath(file_path))
for root in roots:
root_resolved = os.path.realpath(os.path.normpath(root))
root_resolved = os.path.abspath(os.path.normpath(root))
if resolved == root_resolved or resolved.startswith(root_resolved + os.sep):
return