Print form factor.

glob/cnr_utils.py

@@ -68,6 +68,7 @@ async def _get_cnr_data(cache_mode=True, dont_wait=True):
             else:
                 form_factor = 'other'
         
+        print(f"form_factor: {form_factor}")
         while remained:
             # Add comfyui_version and form_factor to the API request
             sub_uri = f'{base_url}/nodes?page={page}&limit=30&comfyui_version={comfyui_ver}&form_factor={form_factor}'

glob/manager_core.py

@@ -43,7 +43,7 @@ import manager_downloader
 from node_package import InstalledNodePackage
 
 
-version_code = [3, 30, 6]
+version_code = [3, 30, 9]
 version_str = f"V{version_code[0]}.{version_code[1]}" + (f'.{version_code[2]}' if len(version_code) > 2 else '')
 
 

glob/manager_server.py

@@ -273,14 +273,23 @@ import zipfile
 import urllib.request
 
 
-def get_model_dir(data, show_log=False):
+def get_model_dir(data, show_log=False) -> str | None:
     if 'download_model_base' in folder_paths.folder_names_and_paths:
         models_base = folder_paths.folder_names_and_paths['download_model_base'][0][0]
     else:
         models_base = folder_paths.models_dir
 
+    # NOTE: Validate to prevent path traversal.
+    if any(char in data['filename'] for char in {'/', '\\', ':'}):
+        return None
+
     def resolve_custom_node(save_path):
         save_path = save_path[13:] # remove 'custom_nodes/'
+
+        # NOTE: Validate to prevent path traversal.
+        if save_path.startswith(os.path.sep) or ':' in save_path:
+            return None
+
         repo_name = save_path.replace('\\','/').split('/')[0] # get custom node repo name
 
         # NOTE: The creation of files within the custom node path should be removed in the future.
@@ -1413,6 +1422,7 @@ async def check_whitelist_for_model(item):
     json_obj = await core.get_data_by_mode('cache', 'model-list.json')
 
     for x in json_obj.get('models', []):
+        if x['save_path'] == item['save_path'] and x['base'] == item['base'] and x['filename'] == item['filename']:
             return True
         
     return False

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "comfyui-manager"
 description = "ComfyUI-Manager provides features to install and manage custom nodes for ComfyUI, as well as various functionalities to assist with ComfyUI."
-version = "3.30.6"
+version = "3.30.9"
 license = { file = "LICENSE.txt" }
 dependencies = ["GitPython", "PyGithub", "matrix-client==0.4.0", "transformers", "huggingface-hub>0.20", "typer", "rich", "typing-extensions", "toml", "uv", "chardet"]