From 49b364887b3595e94579432f652a7fb1e9b49f98 Mon Sep 17 00:00:00 2001 From: Simon Pinfold Date: Thu, 9 Jul 2026 16:17:21 +1200 Subject: [PATCH] fix(assets): repair semantic merge breakage from #14796 and master Two textually-clean but semantically-broken merges: - routes.py lost its folder_paths import when #14796's import block superseded the base's, while the content-type hardening added via the base's master merge still calls folder_paths.is_dangerous_content_type. - master's SVG download-hardening test uploads with the pre-namespacing bare checkpoints tag, which this branch's destination validation rejects; use model_type:checkpoints. --- app/assets/api/routes.py | 1 + tests-unit/assets_test/test_downloads.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/app/assets/api/routes.py b/app/assets/api/routes.py index 40dd35933..43e60094c 100644 --- a/app/assets/api/routes.py +++ b/app/assets/api/routes.py @@ -10,6 +10,7 @@ from typing import Any from aiohttp import web from pydantic import ValidationError +import folder_paths from app import user_manager from app.assets.api import schemas_in, schemas_out from app.assets.services import schemas diff --git a/tests-unit/assets_test/test_downloads.py b/tests-unit/assets_test/test_downloads.py index bfdedc291..d42915893 100644 --- a/tests-unit/assets_test/test_downloads.py +++ b/tests-unit/assets_test/test_downloads.py @@ -23,7 +23,7 @@ def test_download_svg_forced_to_attachment(http: requests.Session, api_base: str svg = b'' files = {"file": ("evil.svg", svg, "image/svg+xml")} form_data = { - "tags": json.dumps(["models", "checkpoints", "unit-tests", "svgxss"]), + "tags": json.dumps(["models", "model_type:checkpoints", "unit-tests", "svgxss"]), "name": "evil.svg", } up = http.post(api_base + "/api/assets", files=files, data=form_data, timeout=120)