Add ComfyUI-Seedance — I2V/T2V nodes for AI short drama production

[qingfengyu153781-star]

Description

Add ComfyUI-Seedance to the dev custom node list.

ComfyUI-Seedance integrates 即梦 Seedance 2.0 via Volcengine Ark API with 8 custom nodes purpose-built for AI short drama production:

Nodes

• Seedance I2V — Image + prompt → video (4-15s, 480p-1080p)
• Seedance T2V — Text → video
• Seedance Playground — Batch prompt testing with multiple seeds
• Prompt Builder — Prefix + base + mood_anchor → combined prompt
• Mood Anchor Preset — 6 preset visual styles
• Style Template — Save/load named style presets for cross-shot consistency
• Cast Loader/Scanner/Saver — Two-tier asset library (project + global)

Key Features

• Provider architecture (hot-swappable video backends)
• Jellyfish-style two-tier asset library
• Style template system for visual consistency
• Audit logging for cost tracking

Repo: https://github.com/qingfengyu153781-star/ComfyUI-Seedance

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bd7dff8d-cf2c-4955-a3b1-14a8e4b82f80

📥 Commits

Reviewing files that changed from the base of the PR and between 9e3a569 and 2737d5a.

📒 Files selected for processing (1)

• node_db/dev/custom-node-list.json

---

📝 Walkthrough

Walkthrough

A new custom node entry for ComfyUI-Seedance (id: comfyui-seedance) authored by qingfengyu153781-star is appended near the top of the custom_nodes list in node_db/dev/custom-node-list.json. The entry includes a GitHub reference, git-clone install type, and a description. The end-of-file brace is adjusted accordingly.

Changes

ComfyUI-Seedance Registry Entry

Layer / File(s)	Summary
ComfyUI-Seedance node object node_db/dev/custom-node-list.json	Inserts a new custom_nodes JSON object for comfyui-seedance with author, title, GitHub reference, git-clone install type, and description; adjusts the terminating end-of-file brace — a seedy little addition that seeds the node scene!

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Warning

⚠️ This pull request has been flagged as potential spam (contributor-gaming) by CodeRabbit slop detection and should be reviewed carefully.

[ltdrdata]

Before this can be merged, several issues need to be addressed:

1. Path traversal (arbitrary MP4 write via download nodes) — SeedanceI2V / SeedanceT2V (seedance_node.py:58-60, 144-146) declare project / episode / shot_label as free STRING inputs and pass them into shared.output_dir(project, episode) (shared.py:57-65) + shared.download_video(...) (shared.py:39-46), which reaches open(save_path, "wb") with attacker-controlled bytes from video_url. A crafted project="../../../tmp" (or similar values in episode/shot_label) writes the downloaded MP4 outside the intended output tree.

2. Path traversal (playground download) — SeedancePlayground (playground_node.py:70-71, 146-168) has the same primitive via label_prefix, which flows into save_path = PLAYGROUND_OUT / f"{label_prefix}_s{seed}_{task_id}.mp4" → open("wb") with no containment.

3. Path traversal (asset writer) — CastSaver.save() (cast_manager.py:349-360) uses free-form STRING name and project unmodified to build COMFY_ROOT/output/seedance/<project>/assets/<kind>/<name>, then mkdir(parents=True) + PIL.Image.save(folder/"portrait.png"). project="../../../etc" (or name containing ..) escapes the output directory.

Root fix for 1–3: canonicalize the intended output base (base_resolved = Path(base).resolve()), then either (a) sanitize each STRING with os.path.basename before joining, or (b) reject any resulting path whose Path(final).resolve().is_relative_to(base_resolved) is False. Apply this in shared.output_dir / shared.download_video and in CastSaver.save before mkdir and the write sink.

4. Non-English UI strings — several NODE_DISPLAY_NAME_MAPPINGS values mix English with Chinese in parentheses (cast_manager.py:372-375, prompt_builder.py:142-143, playground_node.py:207), the provider display name is "Seedance 2.0 (火山引擎)" (providers/seedance.py:19), and the INPUT_TYPES placeholders contain Chinese sample text (cast_manager.py:145, 242, 331). Please write the UI strings in English. For multilingual support, refer to the locale feature: [i18n] Add /i18n endpoint to provide all custom node translations ComfyUI#6558

I'll re-evaluate once the path-traversal chain is contained on all three write sinks and the UI strings are English by default.