feat(custom-node-list): register bada-ya/ComfyUI-Bada-Utils

[bada-ya]

Register a new custom node pack: ComfyUI-Bada-Utils

• Author: bada-ya
• Repository: https://github.com/bada-ya/ComfyUI-Bada-Utils
• Install type: git-clone
• Nodes: BadaPresetHub, BadaRegionalPrompt, VisualGridPromptNode

Description

An All-in-One Quality of Life, Smart Presets Hub, Auto Model Assigner & Visual Regional Prompting Suite for ComfyUI.

Key Features

• 🌊 Bada Preset Hub: Wireless Smart Presets Master Hub with category organization, real-time preview, and 1-click workflow injection.
• 🌊 Bada Visual Regional Prompt: Interactive visual canvas & multi-zone regional prompting with color-coded masks, live bounding preview, and legacy compatibility.
• ⚡ Quality of Life (QoL): Canvas mouse fixes, blank startup canvas option, workflow organizer, and enhanced UI utilities.
• 🎯 Auto Model Assigner: Automatic checkpoint/LoRA/VAE matching and assignment.
• 🌐 Multilingual: Built-in Korean & English UI localization.

Validation

• Passed python json-checker.py custom-node-list.json without errors.
• Clean git URL format without .git suffix.
• License: MIT

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a9350e40-94f9-42a0-aed7-118435a53419

📥 Commits

Reviewing files that changed from the base of the PR and between f82970b and 9a2abe2.

📒 Files selected for processing (1)

• custom-node-list.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The custom node registry now includes ComfyUI-Bada-Utils by bada-ya. The entry defines its GitHub repository, git-clone installation method, single-file source, and feature description.

Changes

Custom node registry

Layer / File(s)	Summary
Add custom node metadata custom-node-list.json	Adds the ComfyUI-Bada-Utils entry with its repository reference, installation settings, author, and feature description.

Suggested reviewers: ltdrdata

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 9a2ab

This adds ComfyUI-Bada-Utils to the custom-node registry with the intended Git repository and clone installation metadata. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

_{Comment @coderabbitai help to get the list of available commands.}

[ltdrdata]

Thanks for the contribution! Two things need addressing before this can be registered:

1. POST /api/bada/workflows/... validates the destination directory with is_safe_path, but then builds the file name from the unvalidated new_name body parameter (server/bada_server_api.py:313/299/317), so a ..-bearing name escapes the workflows directory on write. Please apply the same containment to the final path (realpath + commonpath on the full destination, rejecting absolute and ..), not just the parent directory.
2. The pack ships a Korean/English bilingual UI that auto-selects on the browser language — the i18n table web/bada_i18n.js, a second Korean dictionary web/visual_grid_prompt.js, a Korean parenthetical in NODE_DISPLAY_NAME_MAPPINGS (nodes/bada_regional_prompt.py), and Korean strings across the web/ settings tooltips/dialogs/labels. Please write the UI strings in English. For multilingual support, refer to the locale feature: [i18n] Add /i18n endpoint to provide all custom node translations ComfyUI#6558

I'll re-evaluate once these are addressed.

[bada-ya]

Thank you @ltdrdata for the thorough and helpful review! Both items have been fully addressed in the latest updates:

1. Path Traversal Containment Hardening (server/bada_server_api.py):

   • Explicitly rejects any path traversal patterns (..) in \source_rel, \ arget_folder_rel,
     ew_name, and folder operations.
   • Enforces \os.path.basename\ sanitization on file names to eliminate filename-level path escapes.
   • Applies strict
     ealpath\ + \commonpath\ containment validation (\is_safe_path) on the final destination file path (\dest_full) against both the workflow root directory and the target destination directory prior to any write/move operations.

2. English-First UI & Standard Locale Adoption:

   • Removed all Korean parentheticals from \NODE_DISPLAY_NAME_MAPPINGS\ across all nodes (all display names are now strictly English-first).
   • Set the default UI language across all nodes, settings, tooltips, and modals to English (\en), completely removing automatic browser language override.
   • Adopted ComfyUI's standard locale architecture (PR #6558) with dedicated \web/locales/en.json\ and \web/locales/ko.json\ files for clean multi-language support.

All Python and JavaScript syntax and unit tests pass cleanly. Please re-evaluate when you have a moment. Thank you again!

[bada-ya]

Hi @ltdrdata,

Just following up with a friendly reminder on this PR!

All requested changes (path traversal containment hardening on dest_full and standard English-first locale adoption) were implemented and verified in commit e1d83c4.

Whenever you have a chance, please let me know if any further adjustments are needed or if this is ready to be merged. Thank you for your time!

[ltdrdata]

Thanks for the update, and for the thorough work on the file-path side!

I re-cloned at HEAD and re-checked. A couple of things landed nicely:

• The path handling is confined now — rejecting ".." in the relative paths, sanitizing the file basenames, and doing the realpath + commonpath containment check (is_safe_path) against the workflow root before writing or moving. That closes the earlier path concern, so the save/move side looks good.
• The UI reads as English-first now (en.json with the ko.json fallback, and the automatic browser-language override removed), so the locale side is clear on my end too.

The part that's still open is the built-in terminal API in server/bada_server_api.py. These are open routes with no access control, reachable by any web page the user has open, so a page they visit can drive them from their own machine:

1. POST /api/bada/terminal/exec (server/bada_server_api.py:1484) takes a "command" from the request body and runs it via asyncio.create_subprocess_shell, so any caller can run shell commands on the host. Please make this local-only / explicitly user-initiated, or remove the route.
2. run_terminal_command (server/bada_server_api.py:456) is the shell sink behind that route — it runs the caller-supplied string in a shell (create_subprocess_shell) with no allow-list. Closing route thanks for the project ❤ list from GitHub search "ComfyUI" maybe helps  #1 stops it being network-reachable; if it's callable from any other route, please gate or remove it there too.
3. POST /api/bada/terminal/open_cmd (server/bada_server_api.py:1568) spawns a terminal via subprocess.Popen(shell=True) with a caller-influenced working directory. Same remedy: local-only / explicitly user-initiated, or remove the route.
4. POST /api/bada/customnode/install (server/bada_server_api.py:1629) git-clones a caller-supplied repo URL into custom_nodes and runs pip install on its requirements.txt, which installs and runs arbitrary code. Please restrict the outbound host to an explicit allow-list, or remove the network-reachable install route.
5. POST /api/bada/terminal/restart (server/bada_server_api.py:1515) restarts the ComfyUI process via os.execv/subprocess. Please make this local-only / explicitly user-initiated, or remove the route.

One note in case it comes up: a same-machine / loopback IP check isn't enough here, since a page the user visits makes the request from their own machine — so it would pass that check. The reliable fix is to keep these actions out of network-reachable routes (behind an explicit user action, or removed) and, for the install route, an allow-list of hosts.

I'll re-evaluate once these are addressed.

[bada-ya]

Hi @ltdrdata,

Thank you for the detailed and thorough security review! All five flagged endpoints and security risks have been completely removed or refactored in the latest commit (c8f31ff):

1. POST /api/bada/terminal/exec & run_terminal_command()
   — Removed completely. The shell sink, associated execution routes, and ACTIVE_TERMINAL_TASKS state handling have all been deleted.

2. POST /api/bada/terminal/open_cmd
   — Removed completely.

3. POST /api/bada/customnode/install
   — Removed. install_custom_node_pack() (git clone + pip install) has been deleted. The "Install" button in the UI now routes safely through ComfyUI-Manager's official /customnode/install/git_url API, with a clipboard copy + Manager dialog fallback.

4. POST /api/bada/terminal/restart
   — Removed. The "Restart ComfyUI" feature now reuses ComfyUI-Manager's native /manager/reboot endpoint.

5. Remaining API Surface
   — The only remaining backend route is GET /api/bada/missing-node/lookup, which is a strictly read-only metadata lookup route with zero execution or file-writing capabilities.

(Note: The Terminal Hub features have been completely isolated into a separate experimental branch (feature/bada-terminal-hub) and are fully stripped from this release.)

The changes have been pushed to main. Please re-evaluate whenever you have time. Thank you again for your time and guidance!

[ltdrdata]

Thanks for the quick and thorough turnaround! I re-cloned at c8f31ff and confirmed it: the terminal exec / open_cmd / install / restart routes and the shell-execution code behind them are all gone, and handing install and restart over to ComfyUI-Manager's own endpoints is the right approach.

On the re-check, a few things are left:

1. Deleting the whole workflows folder (server/bada_server_api.py:926-960). In the workflow delete route, a target_path that reduces to an empty relative path resolves to the workflows root itself; the root passes is_safe_path (a directory is always inside itself), so shutil.rmtree removes the user's entire workflows folder in a single request, with no way to undo it. Please refuse the operation when the resolved target equals the workflows root, and consider limiting deletion to files (or requiring an explicit confirmation step in the UI for folders).

2. TLS verification is always turned off for the translation requests (nodes/bada_regional_prompt.py:218-220): the SSL context sets check_hostname = False and verify_mode = CERT_NONE before calling the Google / MyMemory endpoints. That lets anyone on the same network read the prompt text and change the translation that comes back into the prompt. Please keep verification on by default. If you added this because of certificate errors on some setups, make turning verification off an explicit opt-in setting that is off by default, read from the server-side config or an environment variable, never from the workflow or a node input. (If the errors come from Python not finding a CA bundle, ssl.create_default_context(cafile=certifi.where()) may also fix it — certifi is already installed with ComfyUI via requests.)

---

Update — one more item from a fuller re-check:

3. The "Dual Manager" bridge (init.py:17-72, route merge at :43) imports ComfyUI-Manager's legacy backend (comfyui_manager.legacy.manager_server / share_3rdparty) under a swapped route table and appends its routes into the live PromptServer route table. On an install that runs the current Manager without --enable-manager-legacy-ui, this opens the legacy install / pip / update / reboot routes that the user's Manager deliberately does not register. Please don't load or re-register another extension's server modules: drop the route bridge and have the launcher button open whatever Manager UI is already loaded (or only offer it when the legacy UI is enabled).

I'll re-evaluate once these are addressed.

[bada-ya]

Hi @ltdrdata,

Thank you for the super fast follow-up review! Both remaining items have been addressed in our latest commit:

1. Workflow Directory Protection (server/bada_server_api.py)
   — Added explicit guard checks to verify that the resolved destination path is never equal to the workflow root directory (resolved_path == workflows_root). Any attempt to delete the workflow root directory itself is strictly rejected, preventing accidental shutil.rmtree mass-deletion.

2. TLS Verification Restored (nodes/bada_regional_prompt.py)
   — Removed check_hostname = False and verify_mode = CERT_NONE. Standard TLS certificate verification is now enabled by default using standard SSL context (leveraging certifi.where() for robust CA bundle resolution across environment setups).

The changes have been pushed to main. Please re-evaluate when you get a chance. Thank you again!

[bada-ya]

Hi @ltdrdata,

Thank you again for the feedback! We have completely removed the Dual Manager launcher feature, its settings option, and its web script (web/bada_dual_manager.js) in commit d081001 to ensure full compliance with ComfyUI-Manager guidelines.

• Removed web/bada_dual_manager.js
• Removed Dual Manager options from settings UI
• Preserved only independent QoL utilities (Node Smart Care, Workflows+, Tooltip Fixer, Google Translator, Regional Prompt)

The branch is updated and clean. Please re-evaluate when convenient. Thanks!

[ltdrdata]

Thanks for the fast turnaround. I re-cloned at d081001 and confirmed three fixes: the workflows root can no longer be deleted, TLS verification is back on for the translation requests, and the Dual Manager bridge, its settings and its script are gone. It's registered now.

One request: some UI text still shows in Korean even when the language setting is English:

• toasts and tooltips in web/hub_modal.js:425-445 and web/presets_modal.js:443-445
• the copy messages and prompt in web/missing_node_detective.js:180-218
• server error messages in server/gemini_api.py (e.g. :392), which the UI shows as-is

Please make these English when you get a chance. For Korean, the locale feature (locales/<lang>/main.json) is the way to go instead of the in-script dictionaries: Comfy-Org/ComfyUI#6558

[bada-ya]

Hi @ltdrdata,

Thank you so much for your continuous guidance, patience, and the thorough review process! I really appreciate your time and dedication to making ComfyUI-Manager and custom nodes better and more secure.

Following your suggestion, I have updated all remaining hardcoded Korean texts in hub_modal.js, presets_modal.js, missing_node_detective.js, and gemini_api.py to use English defaults. All Korean translations will now be properly served through the standard locale i18n system (bada_i18n.js).

Thanks again for all your help!