Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

disable follow_symlinks in static serving for security reason #2902

Merged
merged 1 commit into from
Feb 25, 2024

Conversation

zombieyang
Copy link
Contributor

@zombieyang zombieyang commented Feb 25, 2024

We can use this command to access all the files in the hosting server when --listen is specified:

curl "http://<comfyhost>:8188/../../../../../../../../../../../../../../etc/passwd"

It may be an issue of aiohttp but I wonder if the follow_symlinks option is neccessary for ComfyUI

@zombieyang
Copy link
Contributor Author

maybe a duplicate of #2661

@akx
Copy link
Contributor

akx commented Feb 25, 2024

Why would follow_symlinks matter for a directory traversal issue?

@comfyanonymous
Copy link
Owner

curl "http://127.0.0.1:8188/../../../../../../../../../../../../../../etc/passwd"

Just returns a 404 for me but follow_symlinks shouldn't be needed anymore because of #1273 so I'm merging this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants