prevent directory traversal in the web UI - #133
Merged
Merged
Conversation
|
Can you please explain what was the issue and how it is fixed ? |
Contributor
Author
|
The issue was that you could send the server a request like The fix is to refuse to send files from outside the current directory. |
dagf2101
approved these changes
Aug 27, 2022
Collaborator
|
Oh god. Thanks for catching that. I've been very focused on the GFPGAN stuff and am only now turning to the web server. |
This was referenced Sep 4, 2022
austinbrown34
pushed a commit
to cognidesign/InvokeAI
that referenced
this pull request
Dec 30, 2022
prevent directory traversal in the web UI
JPPhoto
pushed a commit
to JPPhoto/InvokeAI
that referenced
this pull request
Sep 14, 2026
…by-architecture refactor(architectures): declare architecture facts in one file per architecture
JPPhoto
pushed a commit
to JPPhoto/InvokeAI
that referenced
this pull request
Sep 14, 2026
…erver-driven-model-policies Both branches had found and fixed the same two things independently; the merge keeps this branch's versions, which are the better-structured ones: - the guidance/cfg_scale choice, as `getRecordGuidanceValue` keyed on `guidanceLabel` rather than an inline ternary - ernie-image's `scheduler_applies_to_graph` Removed as obsolete here: invoke-ai#133's `capabilityContract.test.ts`, its snapshot and `test_frontend_capability_parity.py`. They pinned webv2's `BASE_GENERATION` to the registry, and this branch deletes that table in favour of reading the capabilities endpoint — `test_capabilities_fixture.py` is the contract now, in the other direction. Their oxfmt exclusion went with them. Kept from invoke-ai#133 because this branch does not have it: the guidance slider could not hold a value above its 10-wide track, so FLUX Fill's 30 clamped to 10 on first blur. Its regression tests were folded into this branch's own guidance describe block, dropping the three cases already covered there and re-pointing the per-base sweep at the policy instead of the deleted table.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
It's probably not a good idea to run the web UI anywhere an untrusted device could access it. But even so, best not to have this sort of vulnerability.
You might plausibly want to restrict this further, e.g. by not exposing stuff like
dream_log.txt.