From 4f4f1c642ad77886a9b5716ad886cde556858a60 Mon Sep 17 00:00:00 2001 From: Jesse Gonyou <168374102+jessegonyou@users.noreply.github.com> Date: Mon, 2 Jun 2025 06:52:44 -0400 Subject: [PATCH 1/2] Update fix for potential XSS on /view (#8384) * Update fix for potential XSS on /view This commit uses mimetypes to add more restricted filetypes to prevent from being served, since mimetypes are what browsers use to determine how to serve files. * Fix typo Fixed a typo that prevented the program from running --- server.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/server.py b/server.py index 6e283fe3177..aca67a2e7ed 100644 --- a/server.py +++ b/server.py @@ -476,9 +476,8 @@ async def view_image(request): # Get content type from mimetype, defaulting to 'application/octet-stream' content_type = mimetypes.guess_type(filename)[0] or 'application/octet-stream' - # For security, force certain extensions to download instead of display - file_extension = os.path.splitext(filename)[1].lower() - if file_extension in {'.html', '.htm', '.js', '.css'}: + # For security, force certain mimetypes to download instead of display + if content_type in {'text/html', 'text/html-sandboxed', 'application/xhtml+xml', 'text/javascript', 'text/css'}: content_type = 'application/octet-stream' # Forces download return web.FileResponse( From 312d511630db4907c3bed04dee297b28f61941a8 Mon Sep 17 00:00:00 2001 From: comfyanonymous <121283862+comfyanonymous@users.noreply.github.com> Date: Mon, 2 Jun 2025 04:22:02 -0700 Subject: [PATCH 2/2] Style fix. (#8390) --- server.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server.py b/server.py index aca67a2e7ed..f772545dc73 100644 --- a/server.py +++ b/server.py @@ -390,7 +390,7 @@ def image_save_function(image, post, filepath): async def view_image(request): if "filename" in request.rel_url.query: filename = request.rel_url.query["filename"] - filename,output_dir = folder_paths.annotated_filepath(filename) + filename, output_dir = folder_paths.annotated_filepath(filename) if not filename: return web.Response(status=400)