修复路径安全问题

src/SmartSaveImage/core/path_utils.py

@@ -179,11 +179,12 @@ class PathManager:
         # 构建子文件夹结构
         path_segments = self.build_folder_structure(base_path, structure_mode, metadata, user_inputs)
         
-        # 组合完整路径
         if path_segments:
-            return os.path.join(base_path, *path_segments)
+            final_path = os.path.join(base_path, *path_segments)
         else:
-            return base_path
+            final_path = base_path
+        from ..utils.validators import InputValidator
+        return InputValidator.secure_path_join(final_path, "")
     
     def ensure_directory_exists(self, path: str) -> bool:
         """确保目录存在，如果不存在则创建"""

src/SmartSaveImage/nodes/folder_manager.py

@@ -51,7 +51,7 @@ class SmartFolderManager:
                     "tooltip": "Whether to create model folder"
                 }),
                 "enable_seed_folder": ("BOOLEAN", {
-                    "default": True,
+                    "default": False,
                     "tooltip": "Whether to create seed folder"
                 }),
                 "enable_prompt_folder": ("BOOLEAN", {
@@ -136,7 +136,7 @@ class SmartFolderManager:
 
     def generate_path(self, images, base_folder, create_subfolders,
                      enable_date_folder=True, enable_model_folder=True, 
-                     enable_seed_folder=True, enable_prompt_folder=False, enable_custom_folder=False,
+                     enable_seed_folder=False, enable_prompt_folder=False, enable_custom_folder=False,
                      date_format="yyyy-MM-dd", include_time=False,
                      model_source="auto", manual_model_name=None, model_input=None,
                      seed="0", positive_prompt="", negative_prompt="",
@@ -243,11 +243,11 @@ class SmartFolderManager:
                 custom_subfolder = self.path_manager.sanitize_filename(custom_subfolder)
             path_segments.append(custom_subfolder)
         
-        # 构建最终路径
         if path_segments:
             folder_path = os.path.join(base_path, *path_segments)
         else:
             folder_path = base_path
+        folder_path = InputValidator.secure_path_join(folder_path, "")
         
         # 创建文件夹
         if create_subfolders:

src/SmartSaveImage/nodes/image_saver.py

@@ -217,17 +217,12 @@ class SmartImageSaver:
                 print(f"[SmartImageSaver] 预览失败: {e}")
                 return {"ui": {}, "result": (images,)}
         
-        # 确定保存路径
         print(f"[SmartImageSaver] 接收到的folder_path: '{folder_path}' (类型: {type(folder_path)})")
-        if not folder_path:
+        folder_path = InputValidator.secure_path_join(folder_path or "", "")
-            folder_path = folder_paths.get_output_directory()
+        if not os.path.exists(folder_path):
-            print(f"[SmartImageSaver] 文件夹路径为空，使用默认输出目录: {folder_path}")
-        elif not os.path.exists(folder_path):
-            print(f"[SmartImageSaver] 文件夹不存在，尝试创建: {folder_path}")
             try:
                 os.makedirs(folder_path, exist_ok=True)
             except Exception as e:
-                print(f"[SmartImageSaver] 创建文件夹失败: {e}，使用默认输出目录")
                 folder_path = folder_paths.get_output_directory()
         
         # 解析元数据
@@ -277,7 +272,19 @@ class SmartImageSaver:
                     overwrite_existing
                 )
             
-            filepath = os.path.join(folder_path, filename)
+            filepath_candidate = os.path.realpath(os.path.join(folder_path, filename))
+            base_real = os.path.realpath(folder_path)
+            try:
+                if os.path.commonpath([base_real, filepath_candidate]) == base_real:
+                    filepath = filepath_candidate
+                else:
+                    name_root, name_ext = os.path.splitext(filename)
+                    safe_name = self.path_manager.sanitize_filename(os.path.basename(name_root)) + name_ext
+                    filepath = os.path.realpath(os.path.join(base_real, safe_name))
+            except ValueError:
+                name_root, name_ext = os.path.splitext(filename)
+                safe_name = self.path_manager.sanitize_filename(os.path.basename(name_root)) + name_ext
+                filepath = os.path.realpath(os.path.join(folder_paths.get_output_directory(), safe_name))
             
             # 创建备份
             if overwrite_existing and create_backup and os.path.exists(filepath):