alphard/ComfyUI-Lora-Manager
1
0
Fork 0
mirror of https://github.com/willmiao/ComfyUI-Lora-Manager.git synced 2026-08-06 22:10:14 -03:00
Code Issues Packages Projects Releases Wiki Activity

fix(download): prevent path traversal in download template resolution (#1028)

Browse Source
This commit is contained in:
Will Miao
2026-07-20 21:08:18 +08:00
parent 8b0f56c1a6
commit ea80c2224c
4 changed files with 119 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
py/utils/utils.py
View File

@@ -488,6 +488,12 @@ def calculate_relative_path_for_model(
if model_type == "embedding":
formatted_path = formatted_path.replace(" ", "_")
# Sanitize the resolved path to prevent path traversal
formatted_path = formatted_path.lstrip("/")
while "//" in formatted_path:
formatted_path = formatted_path.replace("//", "/")
formatted_path = formatted_path.rstrip("/")
return formatted_path