T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pulid_generate.py:189- Finding
Configurable Unauthenticated ComfyUI Endpoint Can Expose Biometric Reference Images
- Content
View full analysis
str: """Upload a reference image to ComfyUI's input folder. Returns the filename.""" filename = os.path.basename(image_path) with open(image_path, "rb") as f: image_data = f.read() # Multipart form upload boundary = uuid.uuid4().hex content_type, _ = mimetypes.guess_type(image_path) if content_type is None: content_type = "image/jpeg" body = ( f"--{boundary}\r\n" f'Content-Disposition: form-data; name="image"; filename="{filename}"\r\n' f"Content-Type: {content_type}\r\n\r\n" ).encode("utf-8") + image_data + f"\r\n--{boundary}--\r\n".encode("utf-8") req = urllib.request.Request( f"{COMFYUI_URL}/upload/image", data=body, headers={"Content-Type": f"multipart/form-data; boundary={boundary}"}, method="POST", ) with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode()) uploaded_name = result.get("name", filename) print(f"Uploaded reference image: {uploaded_name}", file=sys.stderr) return uploaded_name ``` The upload is invoked automatically after the connectivity check: ```python # Upload reference image print("Uploading reference image...", file=sys.stderr) ref_name = upload_image(args. ...[truncated 2307 chars]- Remediation
View remediation