RomanNum3ral
/
ComfyUI
mirror of https://github.com/Comfy-Org/ComfyUI.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge cf43a3a63e into 6665515349

This commit is contained in:
Jake Lodwick 2026-07-20 13:41:43 +08:00 committed by GitHub
parent 6665515349 cf43a3a63e
commit 3b987cf77f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
comfy_extras/nodes_dataset.py
View File

@ -1556,7 +1556,13 @@ class LoadTrainingDataset(io.ComfyNode):
@classmethod
def execute(cls, folder_name):
# Get dataset directory
dataset_dir = os.path.join(folder_paths.get_output_directory(), folder_name)
output_dir = folder_paths.get_output_directory()
dataset_dir = os.path.join(output_dir, folder_name)
# Prevent path traversal (e.g. folder_name="../../etc")
real_output_dir = os.path.realpath(output_dir)
real_dataset_dir = os.path.realpath(dataset_dir)
if os.path.commonpath((real_output_dir, real_dataset_dir)) != real_output_dir:
raise ValueError(f"Invalid folder_name: path traversal detected")
if not os.path.exists(dataset_dir):
raise ValueError(f"Dataset directory not found: {dataset_dir}")