Added two node packs to custom-node-list.json

[CovertBannana]

ComfyUI_CivitAI_ImagePlus and Unified node pack ComfyUI-ImagePlus.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

💤 Files selected but had no reviewable changes (1)

• custom-node-list.json

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ce031281-b86a-4804-99e7-9a566b4d1bfa

📥 Commits

Reviewing files that changed from the base of the PR and between 7e4d482 and f0bd251.

📒 Files selected for processing (1)

• custom-node-list.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds two new entries to the custom_nodes array in custom-node-list.json: ComfyUI_CivitAI_ImagePlus and ComfyUI-ImagePlus, both authored by CovertBannana, including repository references, install type, and descriptive text.

Changes

Custom node registry update

Layer / File(s)	Summary
Add ImagePlus node entries custom-node-list.json	Two new custom_nodes objects added with author, title, reference URL, files URL, git-clone install type, and descriptions for the ImagePlus-related nodes.

Possibly related PRs

• Comfy-Org/ComfyUI-Manager#2990: Both PRs add new entries to the same custom_nodes registry list in custom-node-list.json.
• Comfy-Org/ComfyUI-Manager#3022: Both PRs add new custom_nodes entries with git-clone install type and matching metadata structure.
• Comfy-Org/ComfyUI-Manager#3034: Both PRs add new git-clone custom node entries to the same registry file.

No sequins here, no diagram deployed — this JSON tweak's too small and unemployed! Just two nodes added, tidy and plus-y, plain and simple, no need to be fussy.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@custom-node-list.json`:
- Around line 3-4: The JSON entry has inconsistent indentation because the
author field uses mixed tabs and spaces, so clean up the formatting in the
object containing author in custom-node-list.json to match the surrounding
indentation style. Keep the content unchanged and normalize the whitespace so
the entire entry uses a consistent indentation pattern like the neighboring
records.
- Around line 12-13: Fix the invalid JSON in custom-node-list.json by adding the
missing commas between array objects: one after the object ending before the
next object begins, and another after the object ending before the Carasibana
entry starts. Keep the array structure consistent so the file remains valid for
downstream consumers such as manager_core.py’s registry loader, scanner.py’s
git-clone URL extraction, and json-checker.py’s validator.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9685d976-8fbf-4416-a9d5-c4657ac15bfa

📥 Commits

Reviewing files that changed from the base of the PR and between e11e903 and 7e4d482.

📒 Files selected for processing (1)

• custom-node-list.json

[coderabbitai]

📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Mixed tabs/spaces in indentation.

Line 3 and Line 4 use tab characters mixed with spaces, inconsistent with the rest of the file's indentation style. Purely cosmetic in JSON but worth tidying for readability parity with neighboring entries.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@custom-node-list.json` around lines 3 - 4, The JSON entry has inconsistent
indentation because the author field uses mixed tabs and spaces, so clean up the
formatting in the object containing author in custom-node-list.json to match the
surrounding indentation style. Keep the content unchanged and normalize the
whitespace so the entire entry uses a consistent indentation pattern like the
neighboring records.

[ltdrdata]

I've registered ComfyUI-ImagePlus in custom-node-list.json.

ComfyUI_CivitAI_ImagePlus is held back due to a server-side request forgery (SSRF) issue:

• civitai_gallery_backend.py:400 — _maybe_fetch_tensor_from_image_url fetches image_url via urllib.request.urlopen in a fallback branch with no host validation. The allowlisted branch (_is_allowed_image_url) only runs when an API key is present and the URL passes the allowlist; otherwise control falls through to the unguarded fallback, so a disallowed URL is still fetched. The URL is attacker-influenceable via the unauthenticated POST /civitai_gallery/set_preview route (no host validation on body['url']), letting a request to the ComfyUI API make the server fetch arbitrary/internal hosts (e.g. http://169.254.169.254/).

Please apply the _is_allowed_image_url() check to the fallback branch as well (and validate the host on the set_preview route before storing the URL). I'll re-evaluate ComfyUI_CivitAI_ImagePlus once the fallback enforces the allowlist.

[CovertBannana]

Thanks for catching the SSRF issue.

I’ve pushed fixes to ComfyUI_CivitAI_ImagePlus.

Changes made:

• _maybe_fetch_tensor_from_image_url() now validates image URLs with _is_allowed_image_url() before every server-side fetch path, including the fallback branch.
• /civitai_gallery/set_preview now validates body["url"] before storing preview state.
• page_url is also validated with _is_allowed_page_url().
• Server-side image fetches now use parsed hostname checks instead of raw netloc matching.
• Redirects are followed only when each redirect target remains on the CivitAI allowlist.

Please re-evaluate when you have a chance.
Thanks.

CB.