InvokeAI 6.13.7__tar.gz → 6.13.8__tar.gz

{invokeai-6.13.7 → invokeai-6.13.8}/InvokeAI.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: InvokeAI
-Version: 6.13.7
+Version: 6.13.8
 Summary: A full-featured AI-assisted image generation environment designed for creatives and enthusiasts.
 Author-email: Invoke <support@invoke.ai>
 License:                                  Apache License

{invokeai-6.13.7 → invokeai-6.13.8}/InvokeAI.egg-info/SOURCES.txt

@@ -24,7 +24,6 @@ invokeai/app/api/routers/board_images.py
 invokeai/app/api/routers/boards.py
 invokeai/app/api/routers/client_state.py
 invokeai/app/api/routers/custom_nodes.py
-invokeai/app/api/routers/download_queue.py
 invokeai/app/api/routers/images.py
 invokeai/app/api/routers/model_manager.py
 invokeai/app/api/routers/model_relationships.py
@@ -375,6 +374,7 @@ invokeai/app/util/metaenum.py
 invokeai/app/util/misc.py
 invokeai/app/util/model_exclude_null.py
 invokeai/app/util/profiler.py
+invokeai/app/util/ssrf.py
 invokeai/app/util/startup_utils.py
 invokeai/app/util/step_callback.py
 invokeai/app/util/suppress_output.py

{invokeai-6.13.7 → invokeai-6.13.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: InvokeAI
-Version: 6.13.7
+Version: 6.13.8
 Summary: A full-featured AI-assisted image generation environment designed for creatives and enthusiasts.
 Author-email: Invoke <support@invoke.ai>
 License:                                  Apache License

{invokeai-6.13.7 → invokeai-6.13.8}/invokeai/app/api/routers/app_info.py

@@ -150,8 +150,9 @@ def _redact_config_secrets(config: InvokeAIAppConfig) -> InvokeAIAppConfig:
     configured.
 
     NOTE: coverage is by convention, not automatic. Only `*_api_key` fields listed in
-    EXTERNAL_PROVIDER_CONFIG_FIELDS plus `remote_api_tokens` are masked. If you add a credential to
-    InvokeAIAppConfig under any other name, you must extend this function or it will be served verbatim.
+    EXTERNAL_PROVIDER_CONFIG_FIELDS plus `remote_api_tokens` and credentials embedded in
+    `download_proxy` are masked. If you add a credential to InvokeAIAppConfig under any other
+    name, you must extend this function or it will be served verbatim.
     """
     updates: dict[str, Any] = {}
 
@@ -166,6 +167,9 @@ def _redact_config_secrets(config: InvokeAIAppConfig) -> InvokeAIAppConfig:
             pair.model_copy(update={"token": REDACTED_SECRET}) for pair in config.remote_api_tokens
         ]
 
+    if config.download_proxy and "@" in config.download_proxy:
+        updates["download_proxy"] = REDACTED_SECRET
+
     return config.model_copy(update=updates) if updates else config
 
 

{invokeai-6.13.7 → invokeai-6.13.8}/invokeai/app/api/sockets.py

@@ -260,6 +260,17 @@ class SocketIO:
     async def _handle_unsub_bulk_download(self, sid: str, data: Any) -> None:
         await self._sio.leave_room(sid, BulkDownloadSubscriptionEvent(**data).bulk_download_id)
 
+    def _admin_sids(self) -> list[str]:
+        """Sockets belonging to administrators, identified at connect time.
+
+        The "admin" room is only entered on queue subscription, so it cannot carry events
+        that are not tied to a queue: a socket that has connected but not yet sent
+        `subscribe_queue` is in no rooms at all and would miss them. `_socket_users` is
+        populated in `_handle_connect`, so addressing those sockets directly covers the
+        window between connect and subscribe.
+        """
+        return [sid for sid, info in self._socket_users.items() if info.get("is_admin")]
+
     async def _handle_queue_event(self, event: FastAPIEvent[QueueEventBase]):
         """Handle queue events with user isolation.
 
@@ -354,7 +365,24 @@ class SocketIO:
             logger.error(f"Error handling queue event {event[0]}: {e}", exc_info=True)
 
     async def _handle_model_event(self, event: FastAPIEvent[ModelEventBase | DownloadEventBase]) -> None:
-        await self._sio.emit(event=event[0], data=event[1].model_dump(mode="json"))
+        event_name, event_data = event
+
+        # Model load events drive the loading-models spinner in every client, so they stay
+        # broadcast. Their `config` does carry `path` and `source`, but any authenticated user
+        # can already read those for every model from `list_model_records`, so broadcasting
+        # them discloses nothing new. (Upstream routes these to the triggering user's room
+        # instead, which needs a `user_id` on the event that this release line does not have.)
+        if isinstance(event_data, (ModelLoadStartedEvent, ModelLoadCompleteEvent)):
+            await self._sio.emit(event=event_name, data=event_data.model_dump(mode="json"))
+            return
+
+        # Model install and download events contain signed source URLs and server filesystem
+        # paths. They feed the admin-only model manager UI and must not be broadcast to users.
+        # Addressed to the admin sockets rather than the "admin" room because that room is only
+        # entered on queue subscription, and these events are not tied to a queue.
+        admin_sids = self._admin_sids()
+        if admin_sids:
+            await self._sio.emit(event=event_name, data=event_data.model_dump(mode="json"), to=admin_sids)
 
     async def _handle_bulk_image_download_event(self, event: FastAPIEvent[BulkDownloadEventBase]) -> None:
         event_name, event_data = event

{invokeai-6.13.7 → invokeai-6.13.8}/invokeai/app/api_app.py

@@ -22,7 +22,6 @@ from invokeai.app.api.routers import (
     boards,
     client_state,
     custom_nodes,
-    download_queue,
     images,
     model_manager,
     model_relationships,
@@ -175,7 +174,6 @@ app.add_middleware(GZipMiddleware, minimum_size=1000)
 app.include_router(auth.auth_router, prefix="/api")
 app.include_router(utilities.utilities_router, prefix="/api")
 app.include_router(model_manager.model_manager_router, prefix="/api")
-app.include_router(download_queue.download_queue_router, prefix="/api")
 app.include_router(images.images_router, prefix="/api")
 app.include_router(boards.boards_router, prefix="/api")
 app.include_router(board_images.board_images_router, prefix="/api")

{invokeai-6.13.7 → invokeai-6.13.8}/invokeai/app/services/config/config_default.py

@@ -122,6 +122,8 @@ class InvokeAIAppConfig(BaseSettings):
         hashing_algorithm: Model hashing algorthim for model installs. 'blake3_multi' is best for SSDs. 'blake3_single' is best for spinning disk HDDs. 'random' disables hashing, instead assigning a UUID to models. Useful when using a memory db to reduce model installation time, or if you don't care about storing stable hashes for models. Alternatively, any other hashlib algorithm is accepted, though these are not nearly as performant as blake3.<br>Valid values: `blake3_multi`, `blake3_single`, `random`, `md5`, `sha1`, `sha224`, `sha256`, `sha384`, `sha512`, `blake2b`, `blake2s`, `sha3_224`, `sha3_256`, `sha3_384`, `sha3_512`, `shake_128`, `shake_256`
         remote_api_tokens: List of regular expression and token pairs used when downloading models from URLs. The download URL is tested against the regex, and if it matches, the token is provided in as a Bearer token.
         scan_models_on_startup: Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.
+        allow_private_download_urls: Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.
+        download_proxy: Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.
         unsafe_disable_picklescan: UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.
         allow_unknown_models: Allow installation of models that we are unable to identify. If enabled, models will be marked as `unknown` in the database, and will not have any metadata associated with them. If disabled, unknown models will be rejected during installation.
         multiuser: Enable multiuser support. When disabled, the application runs in single-user mode using a default system account with administrator privileges. When enabled, requires user authentication and authorization.
@@ -226,6 +228,8 @@ class InvokeAIAppConfig(BaseSettings):
     hashing_algorithm: HASHING_ALGORITHMS = Field(default="blake3_single",  description="Model hashing algorthim for model installs. 'blake3_multi' is best for SSDs. 'blake3_single' is best for spinning disk HDDs. 'random' disables hashing, instead assigning a UUID to models. Useful when using a memory db to reduce model installation time, or if you don't care about storing stable hashes for models. Alternatively, any other hashlib algorithm is accepted, though these are not nearly as performant as blake3.")
     remote_api_tokens: Optional[list[URLRegexTokenPair]] = Field(default=None, description="List of regular expression and token pairs used when downloading models from URLs. The download URL is tested against the regex, and if it matches, the token is provided in as a Bearer token.")
     scan_models_on_startup:        bool = Field(default=False,              description="Scan the models directory on startup, registering orphaned models. This is typically only used in conjunction with `use_memory_db` for testing purposes.")
+    allow_private_download_urls:   bool = Field(default=False,              description="Allow the download queue to fetch from loopback, link-local and private-network addresses. Disabled by default so that a download URL cannot be used to reach services that are only reachable from the server. Enable this only if you install models from a mirror on your own network.")
+    download_proxy:                Optional[str] = Field(default=None,      description="Optional HTTP proxy for model downloads. The proxy must enforce the public-address policy because proxy-side DNS cannot be checked by InvokeAI.")
     unsafe_disable_picklescan:     bool = Field(default=False,              description="UNSAFE. Disable the picklescan security check during model installation. Recommended only for development and testing purposes. This will allow arbitrary code execution during model installation, so should never be used in production.")
     allow_unknown_models:          bool = Field(default=True,              description="Allow installation of models that we are unable to identify. If enabled, models will be marked as `unknown` in the database, and will not have any metadata associated with them. If disabled, unknown models will be rejected during installation.")
 

{invokeai-6.13.7 → invokeai-6.13.8}/invokeai/app/services/download/download_base.py

@@ -7,7 +7,7 @@ from functools import total_ordering
 from pathlib import Path
 from typing import Any, Callable, List, Optional, Set, Union
 
-from pydantic import BaseModel, Field, PrivateAttr
+from pydantic import BaseModel, Field, PrivateAttr, field_serializer
 from pydantic.networks import AnyHttpUrl
 
 from invokeai.backend.model_manager.metadata import RemoteModelFile
@@ -60,6 +60,17 @@ class DownloadJobBase(BaseModel):
     error_type: Optional[str] = Field(default=None, description="Name of exception that caused an error")
     error: Optional[str] = Field(default=None, description="Traceback of the exception that caused an error")
 
+    @field_serializer("dest", "download_path")
+    def _serialize_path(self, path: Optional[Path]) -> Optional[str]:
+        """Emit paths with forward slashes so the wire format does not depend on the server's OS.
+
+        `str(WindowsPath("models/x.bin"))` is `models\\x.bin`, so without this a client that
+        submits a POSIX-style `dest` gets a different spelling back from a Windows host than
+        from a Linux one. The download events already normalise this way - see
+        `DownloadStartedEvent.build` in `events_common.py`.
+        """
+        return path.as_posix() if path is not None else None
+
     # internal flag
     _cancelled: bool = PrivateAttr(default=False)
     _paused: bool = PrivateAttr(default=False)

{invokeai-6.13.7 → invokeai-6.13.8}/invokeai/app/services/download/download_default.py

@@ -6,11 +6,11 @@ import re
 import threading
 import time
 import traceback
-from pathlib import Path
+from pathlib import Path, PurePosixPath, PureWindowsPath
 from queue import Empty, PriorityQueue
 from shutil import disk_usage
 from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Set
-from urllib.parse import urlparse
+from urllib.parse import urljoin, urlparse
 
 import requests
 from pydantic.networks import AnyHttpUrl
@@ -31,6 +31,7 @@ from invokeai.app.services.download.download_base import (
     UnknownJobIDException,
 )
 from invokeai.app.util.misc import get_iso_timestamp
+from invokeai.app.util.ssrf import build_guarded_session, validate_download_url, warn_if_proxied
 from invokeai.backend.model_manager.metadata import RemoteModelFile
 from invokeai.backend.util.logging import InvokeAILogger
 
@@ -71,7 +72,27 @@ class DownloadQueueService(DownloadQueueServiceBase):
         self._lock = threading.Lock()
         self._logger = InvokeAILogger.get_logger("DownloadQueueService")
         self._event_bus = event_bus
-        self._requests = requests_session or requests.Session()
+        # A caller-supplied session is left exactly as given (the tests inject mock
+        # transports). Sessions we build ourselves refuse to connect to a non-public
+        # address, which is the check that holds against DNS rebinding and against host
+        # spellings that `requests` decodes differently from us.
+        self._request_proxies: Optional[Dict[str, str]] = None
+        if requests_session is not None:
+            self._requests = requests_session
+        elif self._app_config.allow_private_download_urls:
+            # The operator has opted out of the address policy, so ambient proxy variables
+            # keep working here exactly as they always have — but an explicitly configured
+            # download_proxy must still be honored rather than silently ignored when both
+            # settings are present. It is applied per request (see the single call site in
+            # _do_download) because that is the only level that takes precedence over
+            # ambient *_PROXY variables in a plain Session.
+            self._requests = requests.Session()
+            if self._app_config.download_proxy:
+                proxy = self._app_config.download_proxy
+                self._request_proxies = {"http": proxy, "https": proxy}
+        else:
+            self._requests = build_guarded_session(proxy=self._app_config.download_proxy)
+            warn_if_proxied(self._requests, self._logger)
         self._accept_download_requests = False
         self._max_parallel_dl = max_parallel_dl
 
@@ -418,8 +439,18 @@ class DownloadQueueService(DownloadQueueServiceBase):
                 job.resume_message = "Partial file missing. Restarted download from the beginning."
 
         # Make a streaming request. This will retrieve headers including
-        # content-length and content-disposition, but not fetch any content itself
-        resp = self._requests.get(str(url), headers=header, stream=True)
+        # content-length and content-disposition, but not fetch any content itself.
+        # The URL is checked here rather than at submit time so that it is the address we
+        # are about to connect to that gets vetted, and the response hook re-checks every
+        # redirect hop — otherwise a public URL could bounce us onto a private address.
+        self._validate_url(url)
+        resp = self._requests.get(
+            str(url),
+            headers=header,
+            stream=True,
+            hooks={"response": self._reject_unsafe_redirect},
+            proxies=self._request_proxies,
+        )
         job.final_url = str(resp.url) if resp.url else None
         self._logger.debug(
             "Resume response: "
@@ -467,6 +498,11 @@ class DownloadQueueService(DownloadQueueServiceBase):
                 if self._validate_filename(job.dest.as_posix(), remote_name):
                     file_name = remote_name
 
+            # The URL path is attacker-influenced too -- a final segment of ".." would
+            # otherwise put download_path one level above dest.
+            if not self._validate_filename(job.dest.as_posix(), file_name):
+                raise ValueError(f"Cannot derive a safe filename for {url} from '{file_name}'")
+
             job.download_path = job.dest / file_name
 
         else:
@@ -578,13 +614,40 @@ class DownloadQueueService(DownloadQueueServiceBase):
         self._logger.debug(f"{job.source}: saved to {job.download_path} (bytes={job.bytes})")
         in_progress_path.rename(job.download_path)
 
+    def _validate_url(self, url: str) -> None:
+        """Refuse to fetch URLs that point at addresses only the server can reach."""
+        validate_download_url(str(url), allow_private_urls=self._app_config.allow_private_download_urls)
+
+    def _reject_unsafe_redirect(self, response: requests.Response, *args: Any, **kwargs: Any) -> requests.Response:
+        """Response hook: vet each redirect target before `requests` follows it."""
+        if response.is_redirect or response.is_permanent_redirect:
+            location = response.headers.get("location")
+            if location:
+                try:
+                    self._validate_url(urljoin(response.url, location))
+                except Exception:
+                    response.close()
+                    raise
+        return response
+
     def _validate_filename(self, directory: str, filename: str) -> bool:
         pc_name_max = get_pc_name_max(directory)
         pc_path_max = get_pc_path_max(directory)
-        if "/" in filename:
+        # The name must be a single path component. A remote server picks this value, so
+        # separators of either flavour, drive letters and '..' all have to be rejected --
+        # on Windows `Path(dir) / "..\\evil"` escapes `dir` even though it has no '/'.
+        if "/" in filename or "\\" in filename:
+            return False
+        if filename in ("", ".", ".."):
             return False
         if filename.startswith(".."):
             return False
+        if PurePosixPath(filename).is_absolute() or PureWindowsPath(filename).is_absolute():
+            return False
+        # `WindowsPath("D:/dest") / "C:evil"` yields "C:evil" -- a drive-relative name
+        # replaces the destination entirely without ever looking absolute.
+        if PureWindowsPath(filename).drive:
+            return False
         if len(filename) > pc_name_max:
             return False
         if len(os.path.join(directory, filename)) > pc_path_max:

{invokeai-6.13.7 → invokeai-6.13.8}/invokeai/app/services/model_install/model_install_default.py

@@ -355,7 +355,8 @@ class ModelInstallService(ModelInstallServiceBase):
         self._logger.debug("calling stop_event.set()")
         self._stop_event.set()
         self._clear_pending_jobs()
-        self._download_cache.clear()
+        with self._lock:
+            self._download_cache.clear()
         assert self._install_thread is not None
         self._install_thread.join()
         self._running = False
@@ -520,7 +521,14 @@ class ModelInstallService(ModelInstallServiceBase):
         self._wait_for_restore_complete()
 
         start = time.time()
-        while len(self._download_cache) > 0:
+        while True:
+            # The completion callback removes a download from this cache while holding
+            # the same lock it uses to enqueue the install. Do not observe the cache
+            # between those two operations.
+            with self._lock:
+                downloads_pending = bool(self._download_cache)
+            if not downloads_pending:
+                break
             if self._downloads_changed_event.wait(timeout=0.25):  # in case we miss an event
                 self._downloads_changed_event.clear()
             if timeout > 0 and time.time() - start > timeout:
@@ -1257,7 +1265,8 @@ class ModelInstallService(ModelInstallServiceBase):
                 part.final_url = meta.get("final_url") or part.final_url
                 if meta.get("download_path"):
                     part.download_path = Path(meta.get("download_path"))
-        self._download_cache[multifile_job.id] = job
+        with self._lock:
+            self._download_cache[multifile_job.id] = job
         job._multifile_job = multifile_job
 
         self._write_install_marker(job, status=InstallStatus.WAITING)