User-controlled file handling should default to containment and non-executable rendering

Summary#

The security PR bundles multiple issues that share one root cause: treating uploaded paths and content as inherently safe. A strong default is to constrain file access to approved roots and force risky content types into download-safe behavior instead of inline rendering.

Problem#

Uploads and file preview endpoints can enable stored XSS or path traversal when content types are rendered inline or filesystem paths are insufficiently bounded.

Solution#

Normalize and validate paths against an allowed directory, prevent traversal outside the intended root, and serve SVG/XML or other user-provided content as downloads or otherwise non-renderable responses.

Failure Modes#

Path normalization happens after file access decisions, leaving traversal gaps
Browsers content-sniff uploaded files into executable contexts
Fixing one endpoint but not parallel preview/load routes leaves the same vulnerability class elsewhere

Sources#

https://github.com/Comfy-Org/ComfyUI/pull/15030
https://github.com/Comfy-Org/ComfyUI/pull/14999
https://github.com/Comfy-Org/ComfyUI/pull/15023
https://github.com/Comfy-Org/ComfyUI/pull/15021
https://github.com/Comfy-Org/ComfyUI/pull/14734
https://github.com/Comfy-Org/ComfyUI/pull/15017
https://github.com/GitHubDaily/GitHubDaily/pull/267
https://github.com/GitHubDaily/GitHubDaily/pull/52
https://github.com/fastapi/full-stack-fastapi-template/pull/2382
https://github.com/fastapi/full-stack-fastapi-template/pull/2380
https://github.com/fastapi/full-stack-fastapi-template/pull/2373
https://github.com/fastapi/full-stack-fastapi-template/pull/2379
https://github.com/fastapi/full-stack-fastapi-template/pull/2363
https://github.com/fastapi/full-stack-fastapi-template/pull/2364
https://github.com/fastapi/full-stack-fastapi-template/pull/2333
https://github.com/fastapi/full-stack-fastapi-template/pull/2375
https://github.com/react/react/pull/37095
https://github.com/react/react/pull/37086
https://github.com/react/react/pull/37090
https://github.com/react/react/pull/37089
https://github.com/react/react/pull/37088
https://github.com/react/react/pull/37087
https://github.com/react/react/pull/37062
https://github.com/react/react/pull/36947
https://github.com/thedaviddias/Front-End-Checklist/pull/664
https://github.com/thedaviddias/Front-End-Checklist/pull/680
mined_at: 2026-07-23T00:46:50Z

Sagwan Revalidation 2026-07-23T01:25:25Z#

verdict: ok
note: 경로 제한과 비실행 렌더링 권장은 현재도 유효한 보안 기본값임