Missing model downloader

[fragmede]

Summary

This PR adds a secure, built-in model downloading system to ComfyUI, allowing users to download missing models directly from the UI without manual intervention or using external tools.

Problem Solved

Currently, when ComfyUI encounters missing models, users must:

1. Manually identify which models are missing
2. Find the download URLs from various sources
3. Download files manually using wget/curl or browser
4. Place them in the correct directories
5. Restart ComfyUI

This is time-consuming and error-prone, especially for new users or when working with complex workflows requiring multiple models.

Solution

This PR implements a secure downloading system with:

🚀 Features

• REST API endpoints for model downloads (/models/download)
• Real-time progress tracking via status endpoint
• Concurrent downloads support with thread management
• Automatic file placement in correct model directories
• Resume support for interrupted downloads

🔒 Security Features

• Path traversal protection - Prevents writing files outside model directories
• Input sanitization - Validates and cleans model types and filenames
• URL validation - Only allows HTTP/HTTPS protocols
• SSRF protection - Blocks downloads from localhost/private networks
• File extension validation - Only allows known model formats (.safetensors, .ckpt, .pt, .pth, .bin)
• Whitelisted model folders - Restricts downloads to approved directories

📁 Files Added

• app/simple_downloader.py - Core download manager with security validations

📝 Files Modified

• server.py - Added download API endpoints

Also see

Also see Comfy-Org/ComfyUI_frontend#5929

API Endpoints

POST /models/download

Starts a new model download.

Request:

{
  "url": "https://huggingface.co/...",
  "model_type": "checkpoints",
  "filename": "model.safetensors"
}

Response:

{
  "task_id": "uuid-here",
  "status": "downloading",
  "progress": 0
}

GET /models/download/{task_id}

Gets download status and progress.

Response:

{
  "task_id": "uuid-here",
  "status": "downloading",
  "progress": 45.2,
  "downloaded_size": 2147483648,
  "total_size": 4294967296,
  "download_speed": 5242880
}

Security Considerations

The implementation includes multiple layers of security:

1. Path Validation: All file paths are validated to ensure they remain within ComfyUI's model directories
2. Input Sanitization: Model types and filenames are sanitized to remove path traversal attempts
3. URL Restrictions: Only HTTPS URLs from public sources are allowed
4. File Type Validation: Only model file extensions are permitted

Testing

The system has been tested with:

• Large model files (>10GB)
• Multiple concurrent downloads
• Various model types (checkpoints, VAE, LoRA, etc.)
• Invalid/malicious inputs (path traversal attempts, SSRF attempts)

Compatibility

• Fully backward compatible
• No changes to existing APIs
• Works with existing ComfyUI frontend (enhanced with companion frontend PR)

Related PR

See companion frontend PR: ComfyUI_frontend#XXX for UI implementation

Future Improvements

Potential enhancements for future PRs:

• Pause/resume functionality persistence
• Download queue management
• Bandwidth limiting options
• Model hash verification
• Integration with model registries

---

Note: This PR focuses on the backend API implementation. The frontend UI components are implemented in a separate PR to the ComfyUI_frontend repository.