9cf91339b7
* Fix SVG previews broken by the stored-XSS forced-download /view and the assets download route force every SVG to application/octet-stream + attachment. That blocks the stored XSS from GHSA-779p-m5rp-r4h4, but it also breaks the SVG node output and Media Assets previews, which request the file with a plain <img>. Exempt only that case. An SVG referenced by an <img> loads in secure static mode with scripting and external references disabled, so the payload cannot fire. The attack needs the SVG to become a document, which arrives with a different Sec-Fetch-Dest. Browsers set that header themselves and page script cannot override it. A missing header, from a non-browser client or a proxy that strips it, fails closed. The blocklist itself is unchanged; this is a call-site gate. * Don't let a cache replay the inline SVG into document context The Sec-Fetch-Dest exemption makes /view and the assets content route vary their Content-Type and Content-Disposition on a request header, but neither response said so. FileResponse emits Last-Modified/ETag and the cache_control middleware skips /view (the filename is in the query string, not the path), so the inline image/svg+xml variant is heuristically cacheable. A cache keyed on the URL alone could hand an entry primed by an <img> load to a later top-level navigation of the same URL, turning the SVG back into a document and re-enabling the stored XSS the forced download blocks. Set Vary: Sec-Fetch-Dest and Cache-Control: no-store on both branches, not just the exempt one: a cached attachment replayed to an <img> would re-break the preview this fix exists to restore. Also strip parameters from content_type before building the assets response. mime_type there is uploader-supplied and unvalidated, and aiohttp rejects a charset in the content_type argument with ValueError, so a stored "image/svg+xml; charset=utf-8" turned a valid inline SVG into a 500. Route-level guards now pin the headers on both branches and the parameterised mime type; all three fail against the previous commit. |
||
|---|---|---|
| .. | ||
| app_test | ||
| assets_test | ||
| comfy_api_test | ||
| comfy_extras_test | ||
| comfy_quant | ||
| comfy_test | ||
| execution_test | ||
| folder_paths_test | ||
| jobs_cancel_test | ||
| prompt_server_test | ||
| security_test | ||
| seeder_test | ||
| server/utils | ||
| server_test | ||
| utils | ||
| README.md | ||
| deploy_environment_test.py | ||
| feature_flags_test.py | ||
| requirements.txt | ||
| websocket_feature_flags_test.py | ||
README.md
Pytest Unit Tests
Install test dependencies
pip install -r tests-unit/requirements.txt
Run tests
pytest tests-unit/