[PR #2915] [CLOSED] Add ComfyUI-MoonNodes to custom node list #2877

New issue

Closed

opened 2026-10-28 21:13:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-28 21:13:22 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/ComfyUI-Manager/pull/2915
Author: @m0rtus59
Created: 5/25/2026
Status: ❌ Closed

Base: main ← Head: main

📝 Commits (2)

354d6b3 Update custom-node-list.json
c832b23 Merge branch 'Comfy-Org:main' into main

📊 Changes

1 file changed (+8 additions, -0 deletions)

View changed files

📝 custom-node-list.json (+8 -0)

📄 Description

Multi-area regional prompting nodes featuring a layered canvas mask GUI, greedy text encoder, and Gemini API persistent chat utilities.

This repository exposes a custom web route (/moon/save_masks) in moon_mask_maker_gui.py to allow the interactive painting GUI to communicate with the ComfyUI backend. The security architecture is designed to prevent remote code execution and directory traversal:

Input Sanitization (No Directory Traversal): The node_id parameter passed from the browser is strictly sanitized using alphanumeric-only filtering ("".join(c for c in node_id if c.isalnum() or c in "-_")). This prevents attackers from passing path traversal sequences (like ../) to write files outside of ComfyUI's standard workspace.
No Arbitrary File Writes: The route does not save raw, arbitrary binary streams to disk. Instead, the uploaded Base64 image streams are passed through Pillow (PIL.Image.open), converted, and re-encoded from scratch using Pillow's native, compiled PNG encoder. This strictly sanitizes the files and strips out any malicious executable payloads or steganographic scripts.
Sandboxed Directory: All files and previews are strictly written inside ComfyUI's official, designated sandbox directory for temporary assets (folder_paths.get_input_directory()).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/ComfyUI-Manager/pull/2915 **Author:** [@m0rtus59](https://github.com/m0rtus59) **Created:** 5/25/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (2) - [`354d6b3`](https://github.com/Comfy-Org/ComfyUI-Manager/commit/354d6b39545744102a193cf5f651780f50f70aad) Update custom-node-list.json - [`c832b23`](https://github.com/Comfy-Org/ComfyUI-Manager/commit/c832b23a0e0a67cfd7f7a86c575b0bcd38a08a72) Merge branch 'Comfy-Org:main' into main ### 📊 Changes **1 file changed** (+8 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `custom-node-list.json` (+8 -0) </details> ### 📄 Description Multi-area regional prompting nodes featuring a layered canvas mask GUI, greedy text encoder, and Gemini API persistent chat utilities. This repository exposes a custom web route (`/moon/save_masks`) in `moon_mask_maker_gui.py` to allow the interactive painting GUI to communicate with the ComfyUI backend. The security architecture is designed to prevent remote code execution and directory traversal: * **Input Sanitization (No Directory Traversal):** The `node_id` parameter passed from the browser is strictly sanitized using alphanumeric-only filtering (`"".join(c for c in node_id if c.isalnum() or c in "-_")`). This prevents attackers from passing path traversal sequences (like `../`) to write files outside of ComfyUI's standard workspace. * **No Arbitrary File Writes:** The route does not save raw, arbitrary binary streams to disk. Instead, the uploaded Base64 image streams are passed through Pillow (`PIL.Image.open`), converted, and re-encoded from scratch using Pillow's native, compiled PNG encoder. This strictly sanitizes the files and strips out any malicious executable payloads or steganographic scripts. * **Sandboxed Directory:** All files and previews are strictly written inside ComfyUI's official, designated sandbox directory for temporary assets (`folder_paths.get_input_directory()`). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-28 21:13:22 +00:00