{"record":{"id":"c74cc168e042ff2b","repo":"Comfy-Org/ComfyUI","slug":"invalid-file-path-r","errorCode":null,"errorMessage":"Invalid file path: {!r}","messagePattern":"Invalid file path: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"folder_paths.py","lineNumber":356,"sourceCode":"        # byte, and by commonpath() on Windows when the paths are on different\n        # drives. In either case the target is not safely within the directory.\n        return False\n\n\ndef get_annotated_filepath(name: str, default_dir: str | None=None) -> str:\n    name, base_dir = annotated_filepath(name)\n\n    if base_dir is None:\n        if default_dir is not None:\n            base_dir = default_dir\n        else:\n            base_dir = get_input_directory()  # fallback path\n\n    filepath = os.path.abspath(os.path.join(base_dir, name))\n    # Prevent path traversal: the resolved path must stay within base_dir.\n    # repr() the name in the message so a crafted value can't inject log lines.\n    if not is_within_directory(base_dir, filepath):\n        raise ValueError(\"Invalid file path: {!r}\".format(name))\n    return filepath\n\n\ndef exists_annotated_filepath(name) -> bool:\n    name, base_dir = annotated_filepath(name)\n\n    if base_dir is None:\n        base_dir = get_input_directory()  # fallback path\n\n    filepath = os.path.abspath(os.path.join(base_dir, name))\n    # Treat traversal attempts as non-existent rather than probing the filesystem.\n    if not is_within_directory(base_dir, filepath):\n        return False\n    return os.path.exists(filepath)\n\n\ndef add_model_folder_path(folder_name: str, full_folder_path: str, is_default: bool = False) -> None:\n    global folder_names_and_paths","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/Comfy-Org/ComfyUI/blob/1c6d8d45b3693bfbb32385b410d813a7fd6be216/folder_paths.py#L338-L374","documentation":"folder_paths.resolve/annotated path resolution joins the requested name with a base directory (explicit annotation, default_dir, or the input directory) and requires the absolute resolved path to stay within that base via is_within_directory. Any name that escapes the base ('../secrets.env', absolute paths that resolve outside, symlinked traversal via abspath) is rejected as a path-traversal attempt; the name is repr()'d so it cannot inject log lines.","triggerScenarios":"Passing a filename containing '../' sequences that resolve above base_dir; an absolute path whose normalization lands outside the base; a load-image/load-video widget value containing traversal characters; API prompts with crafted filenames.","commonSituations":"Manually typed widget values with '../' to reach files elsewhere; workflows referencing files by paths from a different machine's directory layout; security testing of the prompt API.","solutions":["Place the file inside the expected base directory (e.g. input/) and reference it by relative name only","Use the '[subdir]' annotation syntax supported by annotated_filepath instead of '../' traversal","Sanitize user-supplied filenames: reject '..' components and absolute paths before calling the API"],"exampleFix":"# before\npath = get_annotated_filepath(\"../../etc/passwd\")\n\n# after\npath = get_annotated_filepath(\"my_video.mp4\")  # file lives in input/","handlingStrategy":"type-guard","validationCode":"import os\nname = os.path.normpath(name)\nassert not os.path.isabs(name) and \"..\" not in name.split(os.sep), \"traversal-style filename rejected\"","typeGuard":"def is_safe_relative_name(name: str) -> bool:\n    n = os.path.normpath(name)\n    return not os.path.isabs(n) and \"..\" not in n.split(os.sep)","tryCatchPattern":"try:\n    p = get_annotated_filepath(name)\nexcept ValueError:\n    # treat as user error: reject input, do not probe alternates\n    raise","preventionTips":["Only reference files by names relative to the input directory","Sanitize external filenames (strip '..' and absolute components) at the API boundary"],"tags":["security","path-traversal","file-paths","validation"],"backgroundTag":null,"analyzedSha":"1c6d8d45b3693bfbb32385b410d813a7fd6be216","analyzedAt":"2026-08-14T19:37:18.893Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}