[GH-ISSUE #3279] comfyui_queue_manager 0.1.1 release stuck with NodeVersionStatusFlagged status - file-manager commands, SQLite, and React false positives #1134

New issue

Closed

opened 2026-10-27 21:26:04 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-27 21:26:04 +00:00

Owner

Originally created by @QuietNoise on GitHub (Sep 14, 2026).
Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3279

Hi team,

Please review ComfyUI Queue Manager 0.1.1, published September 14, 2026, currently marked NodeVersionStatusFlagged. The extension manages queued jobs, completed results, and generated files. Its securoty scan report contains seven findings, all with top-level severity info.

Publisher: edgerunner
Node: comfyui_queue_manager
Registry page
Source repository
Full scan reports — see version 0.1.1.

Below are my responses to flags from the scanner:

1–3. Open image location — src/comfyui_queue_manager/helpers.py, lines 31, 33, 36

subprocess.run(["explorer", "/select,", path])  # Windows: select file in Explorer
subprocess.run(["open", "-R", path])          # macOS: reveal file in Finder
subprocess.run(["xdg-open", folder])           # Linux: open containing folder

These are separate OS-specific branches supporting the gallery's Open image location button. Only the relevant branch runs. Launching the system file manager is necessary for this implementation of the feature.

All three trigger python_command_injection_risk. They use fixed command names and separate arguments, without shell=True. Before calling the helper, the code checks that the filename and subfolder match a recorded output for the selected job, builds the path from ComfyUI's output directory, and converts it to an absolute path.

4–5. Local database — src/comfyui_queue_manager/qm_db.py, line 10

_local.conn = sqlite3.connect(DB_PATH, check_same_thread=False)

This opens data/qm-queue.db within the extension directory. The database stores jobs, status, options, and output metadata, supporting persistence between restarts and paginated results.

The same line triggers both python_database_connections and python_network_operations. The database detection is expected, but the network classification appears incorrect: this is local SQLite file access. The network rule matches the generic .connect( substring. check_same_thread=False concerns Python thread access, not networking.

6. React function binding — web/.gui/assets/index.js

The python_network_operations rule matches ten .bind( calls in JavaScript. The source map identifies their source as React's react-dom-client.production.js. JavaScript minification is disabled to make these locations readable.

These appear to be hard false positives.

7. Dependency lockfile — src/gui/package-lock.json, line 1

This is just a lock file for build of the extension's React frontend.

I also wonder if I should request these reviews with every release of my plugin or is the review something you do anyway? If anything I would like to make the process as smooth as possible for you.

Originally created by @QuietNoise on GitHub (Sep 14, 2026). Original GitHub issue: https://github.com/Comfy-Org/ComfyUI-Manager/issues/3279 Hi team, Please review **ComfyUI Queue Manager 0.1.1**, published September 14, 2026, currently marked `NodeVersionStatusFlagged`. The extension manages queued jobs, completed results, and generated files. Its securoty scan report contains seven findings, all with top-level severity `info`. - Publisher: `edgerunner` - Node: `comfyui_queue_manager` - [Registry page](https://registry.comfy.org/publishers/edgerunner/nodes/comfyui_queue_manager) - [Source repository](https://github.com/QuietNoise/comfyui_queue_manager) - [Full scan reports](https://api.comfy.org/nodes/comfyui_queue_manager/versions?include_status_reason=true) — see version `0.1.1`. Below are my responses to flags from the scanner: **1–3. Open image location — `src/comfyui_queue_manager/helpers.py`, lines 31, 33, 36** ```python subprocess.run(["explorer", "/select,", path]) # Windows: select file in Explorer subprocess.run(["open", "-R", path]) # macOS: reveal file in Finder subprocess.run(["xdg-open", folder]) # Linux: open containing folder ``` These are separate OS-specific branches supporting the gallery's **Open image location** button. Only the relevant branch runs. Launching the system file manager is necessary for this implementation of the feature. All three trigger `python_command_injection_risk`. They use fixed command names and separate arguments, without `shell=True`. Before calling the helper, the code checks that the filename and subfolder match a recorded output for the selected job, builds the path from ComfyUI's output directory, and converts it to an absolute path. **4–5. Local database — `src/comfyui_queue_manager/qm_db.py`, line 10** ```python _local.conn = sqlite3.connect(DB_PATH, check_same_thread=False) ``` This opens `data/qm-queue.db` within the extension directory. The database stores jobs, status, options, and output metadata, supporting persistence between restarts and paginated results. The same line triggers both `python_database_connections` and `python_network_operations`. The database detection is expected, but the network classification appears incorrect: this is local SQLite file access. The network rule matches the generic `.connect(` substring. `check_same_thread=False` concerns Python thread access, not networking. **6. React function binding — `web/.gui/assets/index.js`** The `python_network_operations` rule matches ten `.bind(` calls in JavaScript. The source map identifies their source as React's `react-dom-client.production.js`. JavaScript minification is disabled to make these locations readable. These appear to be hard false positives. **7. Dependency lockfile — `src/gui/package-lock.json`, line 1** This is just a lock file for build of the extension's React frontend. I also wonder if I should request these reviews with every release of my plugin or is the review something you do anyway? If anything I would like to make the process as smooth as possible for you.

bsakaguchi closed this issue

2026-10-27 21:26:04 +00:00

bsakaguchi commented

2026-10-27 21:26:06 +00:00

Author

Owner

@QuietNoise commented on GitHub (Oct 19, 2026):

Thanks for reviewing and approving the latest version 🤩

@QuietNoise commented on GitHub (Oct 19, 2026): Thanks for reviewing and approving the latest version 🤩