fix tests

browser_tests/utils/devtoolsSync.ts

@@ -2,10 +2,19 @@ import fs from 'fs-extra'
 import path from 'path'
 import { fileURLToPath } from 'url'
 
-export function syncDevtools(targetComfyDir: string) {
+export function syncDevtools(targetComfyDir: string): boolean {
   if (!targetComfyDir) {
     console.warn('syncDevtools skipped: TEST_COMFYUI_DIR not set')
-    return
+    return false
+  }
+
+  // Validate and sanitize the target directory path
+  const resolvedTargetDir = path.resolve(targetComfyDir)
+
+  // Basic path validation to prevent directory traversal
+  if (resolvedTargetDir.includes('..') || !path.isAbsolute(resolvedTargetDir)) {
+    console.error('syncDevtools failed: Invalid target directory path')
+    return false
   }
 
   const moduleDir =
@@ -19,11 +28,11 @@ export function syncDevtools(targetComfyDir: string) {
     console.warn(
       `syncDevtools skipped: source directory not found at ${devtoolsSrc}`
     )
-    return
+    return false
   }
 
   const devtoolsDest = path.resolve(
-    targetComfyDir,
+    resolvedTargetDir,
     'custom_nodes',
     'ComfyUI_devtools'
   )
@@ -35,7 +44,9 @@ export function syncDevtools(targetComfyDir: string) {
     fs.ensureDirSync(devtoolsDest)
     fs.copySync(devtoolsSrc, devtoolsDest, { overwrite: true })
     console.warn('syncDevtools: copy complete')
+    return true
   } catch (error) {
     console.error(`Failed to sync DevTools to ${devtoolsDest}:`, error)
+    return false
   }
 }