security: fix four vulnerabilities (GHSA-779p-m5rp-r4h4)

[mattmillerai]

Coordinated-disclosure fixes for GHSA-779p-m5rp-r4h4 (reported via CISA VINCE).

CVEs fixed

CVE	Issue	Fix
CVE-2026-56670	Stored XSS via SVG upload on /view	Force download of SVG/XML responses
CVE-2026-56671	Path traversal in /experiment/models/preview	Contain reads within the model folder
CVE-2026-56672	Stored XSS via /userdata/{file} content-type sniffing	Stop inline rendering of uploaded content
CVE-2026-56673	Path traversal in LoadImage via /prompt	Harden get_annotated_filepath

Not included

• CVE-2026-56674 (Origin: null CSRF): assessed as already mitigated by the pre-existing Sec-Fetch-Site: cross-site check on current browsers. The null-origin change was reverted to avoid breaking legitimate sandboxed-iframe embeds. This CVE is being disputed with CISA rather than fixed.

Notes

• Adds regression tests under tests-unit/security_test/ (four findings).
• Please squash-merge (default-branch linear-history rule).

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR addresses GHSA-779p-m5rp-r4h4, fixing content-type sniffing/stored-XSS, path traversal, and CSRF issues. It adds DANGEROUS_CONTENT_TYPES/is_dangerous_content_type and is_within_directory helpers in folder_paths.py, applies them to asset download, userdata, model preview, and image view endpoints to force safe content-types/attachment disposition and block directory/symlink traversal. It also extracts loopback-aware origin CSRF logic into a new utils/origin_check.py module used by server.py, and adds extensive unit tests covering each fix.

Changes

Cohort / File(s)	Summary
folder_paths.py	Added DANGEROUS_CONTENT_TYPES, is_dangerous_content_type(), is_within_directory(); hardened get_annotated_filepath() and exists_annotated_filepath()
app/assets/api/routes.py	Replaced hardcoded MIME list with is_dangerous_content_type() check in download_asset_content
app/user_manager.py	Enforced safe content-type, nosniff, and attachment headers on /userdata/{file}
server.py	Reworked view_image disposition/header logic; delegated origin CSRF checks to new module
app/model_manager.py	Hardened model preview route with input validation and directory containment checks
utils/origin_check.py	New module with is_loopback() and is_cross_origin_forbidden()
tests-unit/**	Added regression tests for SVG XSS, userdata XSS, preview traversal, annotated traversal, dangerous content types, and origin CSRF; updated existing folder_paths test assertions

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Endpoint
  participant FolderPaths
  Client->>Endpoint: request file/asset with content-type
  Endpoint->>FolderPaths: is_dangerous_content_type(content_type)
  FolderPaths-->>Endpoint: True/False
  alt dangerous
    Endpoint-->>Client: octet-stream, attachment, nosniff
  else safe
    Endpoint-->>Client: original content-type
  end

Loading

Related PRs: None specified.

Suggested labels: security, needs-review

Suggested reviewers: None specified.

Poem
A rabbit hops through code so deep,
Patching holes where XSS could creep,
Traversal blocked, and origins checked,
Loopback CSRF now correctly wrecked,
Hop, hop, hooray—the burrow's secure and neat!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches the PR's security-focused vulnerability fixes, though it understates the number of issues.
Description check	✅ Passed	The description is about the same GHSA security fixes and regression tests, even though one CVE note is inconsistent.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Cursor Review — Consolidated panel

Triggered by @mattmillerai.

Found 8 finding(s).

Severity	Count
🟠 High	1
🟡 Medium	4
🟢 Low	2
⚪ Nit	1

Panel: 8/8 reviewers contributed findings.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

tests-unit/security_test/test_ghsa_779p_05_dangerous_content_types.py (1)

8-14: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Docstring describes a stale/bypassable mechanism.

This describes the /view closure as checking content_type in folder_paths.DANGEROUS_CONTENT_TYPES (raw set membership), but the actual handler (per server.py's view_image) calls folder_paths.is_dangerous_content_type(content_type), which normalizes casing/params/XML dialects — that's the whole point of the hardening this test file documents. Worth correcting so future readers don't think the raw membership check (the bypassable one) is what's actually gating /view.

✏️ Suggested docstring fix

-The /view forced-download decision lives in a closure inside
-server.PromptServer.add_routes (server.py ~line 624), which checks
-`content_type in folder_paths.DANGEROUS_CONTENT_TYPES` and, on a match, rewrites
-the response to application/octet-stream with a Content-Disposition: attachment
-header. server.py cannot be imported in a unit test (importing it spins up the
+The /view forced-download decision lives in a closure inside
+server.PromptServer.add_routes (server.py ~line 624), which checks
+`folder_paths.is_dangerous_content_type(content_type)` and, on a match, rewrites
+the response to application/octet-stream with a Content-Disposition: attachment
+header. server.py cannot be imported in a unit test (importing it spins up the

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests-unit/security_test/test_ghsa_779p_05_dangerous_content_types.py` around
lines 8 - 14, Update the test docstring/comments in the security test to
describe the actual /view gating logic, not the stale raw membership check.
Reference the view handler path via server.PromptServer.add_routes and the
view_image behavior, and make it clear that the closure uses
folder_paths.is_dangerous_content_type(...) rather than direct content_type in
folder_paths.DANGEROUS_CONTENT_TYPES membership. Keep the explanation aligned
with the hardened, normalized check so readers understand the test is pinning
the underlying dangerous-content data, not the bypassable raw set lookup.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests-unit/security_test/test_ghsa_779p_03_annotated_traversal.py`:
- Around line 72-95: The symlink-escape test is not safe to run unconditionally
on Windows because os.symlink may require elevated privileges or Developer Mode.
Update test_is_within_directory_symlink_escape to add the same
platform/permission guard used by the other symlink tests, so the symlink setup
and assertion are skipped on Windows CI when symlinks are unavailable.

---

Nitpick comments:
In `@tests-unit/security_test/test_ghsa_779p_05_dangerous_content_types.py`:
- Around line 8-14: Update the test docstring/comments in the security test to
describe the actual /view gating logic, not the stale raw membership check.
Reference the view handler path via server.PromptServer.add_routes and the
view_image behavior, and make it clear that the closure uses
folder_paths.is_dangerous_content_type(...) rather than direct content_type in
folder_paths.DANGEROUS_CONTENT_TYPES membership. Keep the explanation aligned
with the hardened, normalized check so readers understand the test is pinning
the underlying dangerous-content data, not the bypassable raw set lookup.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f3d7af24-b907-4bbc-ab95-78b13db88f98

📥 Commits

Reviewing files that changed from the base of the PR and between 35c1470 and 8a275f1a10a32254d1c2ae8ecd4f3980f77f3bf9.

📒 Files selected for processing (14)

• app/assets/api/routes.py
• app/model_manager.py
• app/user_manager.py
• folder_paths.py
• server.py
• tests-unit/assets_test/test_downloads.py
• tests-unit/comfy_test/folder_path_test.py
• tests-unit/security_test/__init__.py
• tests-unit/security_test/test_ghsa_779p_01_origin_csrf.py
• tests-unit/security_test/test_ghsa_779p_02_preview_traversal.py
• tests-unit/security_test/test_ghsa_779p_03_annotated_traversal.py
• tests-unit/security_test/test_ghsa_779p_04_userdata_xss.py
• tests-unit/security_test/test_ghsa_779p_05_dangerous_content_types.py
• utils/origin_check.py

[guill]

Approved assuming CI passes