[PR #21] [MERGED] fix(transport): sanitize server-influenced output extension #23

New issue

Closed

opened 2026-10-26 22:34:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:34:03 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/comfy-swift-sdk/pull/21
Author: @mattmillerai
Created: 6/21/2026
Status: ✅ Merged
Merged: 6/21/2026
Merged by: @mattmillerai

Base: main ← Head: fix/sanitize-output-extension

📝 Commits (1)

a15a4aa fix(transport): sanitize server-influenced output extension before path composition

📊 Changes

2 files changed (+45 additions, -1 deletions)

View changed files

📝 Sources/ComfySwiftSDK/Internal/Transport.swift (+13 -1)
➕ Tests/ComfySwiftSDKTests/OutputExtensionSanitizationTests.swift (+32 -0)

📄 Description

Closes #15.

Transport composed the downloaded-output cache path as UUID().<suggestedExtension>, with suggestedExtension derived from the server response. A /, \, or .. in it could shape the write outside the intended filename inside the caches directory.

Fix: a static sanitizedExtension(_:) — lowercased, constrained to [a-z0-9]{1,10}, falling back to bin. Anything with slashes, dots, traversal, empty, or >10 chars collapses to bin, so the result can never escape the UUID().<ext> shape.

Unit tests cover ../-style, slash/backslash-bearing, empty, dotted, and overlong extensions, plus pass-through of ordinary ones (png, JPEG→jpeg, mp4, webp).

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/comfy-swift-sdk/pull/21 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 6/21/2026 **Status:** ✅ Merged **Merged:** 6/21/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `fix/sanitize-output-extension` --- ### 📝 Commits (1) - [`a15a4aa`](https://github.com/Comfy-Org/comfy-swift-sdk/commit/a15a4aa49b9056ef5d7ad67cc6b4dd8b89fff5c8) fix(transport): sanitize server-influenced output extension before path composition ### 📊 Changes **2 files changed** (+45 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `Sources/ComfySwiftSDK/Internal/Transport.swift` (+13 -1) ➕ `Tests/ComfySwiftSDKTests/OutputExtensionSanitizationTests.swift` (+32 -0) </details> ### 📄 Description Closes #15. `Transport` composed the downloaded-output cache path as `UUID().<suggestedExtension>`, with `suggestedExtension` derived from the server response. A `/`, `\`, or `..` in it could shape the write outside the intended filename inside the caches directory. **Fix:** a static `sanitizedExtension(_:)` — lowercased, constrained to `[a-z0-9]{1,10}`, falling back to `bin`. Anything with slashes, dots, traversal, empty, or >10 chars collapses to `bin`, so the result can never escape the `UUID().<ext>` shape. Unit tests cover `../`-style, slash/backslash-bearing, empty, dotted, and overlong extensions, plus pass-through of ordinary ones (`png`, `JPEG`→`jpeg`, `mp4`, `webp`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:34:03 +00:00