Security Fix

[ash-bluepollution95]

PR: Major Overhaul - Parsing, Stability, UI, Security, and Docs

Closes: #(issue_number_1), #(issue_number_2) (Optional: Link to any issues this PR resolves)

This pull request introduces a significant set of improvements and features, representing a substantial leap forward in the development of Dataset-Tools. It focuses on enhancing core stability, overhauling the metadata parsing pipeline, adding key usability features like drag-and-drop, integrating new custom parsers, and updating project documentation for clarity and accuracy.

⚡ Key Highlights & New Features

• Drag and Drop Support: Users can now drag and drop image/model files or entire folders directly onto the main application window for easier loading. Dropped single files are auto-selected.
• New Custom Parsers:
  • RuinedFooocusFormat: Added support for RuinedFooocus JSON metadata.
  • CivitaiComfyUIFormat: Added support for Civitai's ComfyUI-based UserComment metadata, including mojibake decoding.
  • Enabled GGUFParser: Basic metadata extraction from .gguf model files is now functional.
• Major Stability Improvements: Addressed numerous critical bugs related to imports, attribute access, and type errors across the application.
• Enhanced Vendored Code: Significantly refactored the adapted sd-prompt-reader components for better status handling, error reporting, and integration.
• Security Hardening: Fixed XML parsing vulnerabilities by integrating defusedxml.
• Improved Code Quality: Applied extensive linting fixes using Ruff, adhering more closely to PEP 8 and improving maintainability.
• Updated Documentation: README.md and SECURITY.MD have been overhauled; NOTICE.md added for vendored code attribution.

🐛 Core Stability & Bug Fixes

• Resolved critical import errors (ModuleNotFoundError, NameError) across ui.py, logger.py, correct_types.py, and vendored_sdpr/* by correcting import paths and resolving circular dependencies.
• Fixed AttributeError: 'str' object has no attribute 'value' by refactoring EmptyField, UpField, DownField in correct_types.py to be proper enum.Enum classes. UI and parsers now correctly use .value and get_ordered_labels().
• Fixed AttributeError in widgets.py related to ExtensionType by using correct attribute names (e.g., SCHEMA_FILES, MODEL_FILES).
• Resolved TypeError for parser __init__ calls (e.g., for A1111) in ImageDataReader by ensuring passed arguments match parser signatures.
• Fixed ValueError: not enough values to unpack in A1111._sd_format() by correcting regex match unpacking.
• Addressed NameError: name 'Path' is not defined in ImageDataReader by adding the pathlib.Path import.
• Eliminated F811 Redefinition of unused __init__ in access_disk.py.
• Corrected F821 Undefined name traceback in access_disk.py by importing traceback.

⚙️ Vendored SD-Prompt-Reader Enhancements & Fixes

• Refactored ImageDataReader._try_parser() helper for clearer instantiation and more robust status checking of individual format parsers.
• Ensured ImageDataReader.status is accurately updated based on the success/failure of sub-parsers, resolving previously misleading FORMAT_ERROR reports.
• Improved status and error message handling within individual format parsers (e.g., A1111._process() now reliably sets its own success/failure status).
• Standardized logger names within the vendored_sdpr components to use the "DSVendored_SDPR" prefix.
• Pruned vendored_sdpr/format/utility.py to essential functions, removing unused GUI dependencies.
• Integrated defusedxml for safer XML parsing in ImageDataReader (for DrawThings XMP data), addressing Bandit-flagged vulnerabilities (B408, B318). Added defusedxml as a project dependency.

✨ New Parser Integrations

(Covered in Key Highlights)

🎨 Code Quality & Linting (Ruff)

Applied extensive linting fixes across the codebase using Ruff (ruff format . and ruff check . --fix):

• Resolved numerous E701, E702, E703 style issues (multiple statements per line, semicolons).
• Removed many F401 (unused imports) and F841 (unused local variables) after careful review.
• Corrected F403/F405 related to star imports.
• Fixed E741 (ambiguous variable names).
• Resolved E722 (bare except).
• Corrected F541 (f-strings without placeholders).

These changes significantly improve code readability, maintainability, and adherence to PEP 8.

🔊 Logging System Improvements

• Resolved the WARNING in main.py regarding logger reconfiguration by aligning the function call to reconfigure_all_loggers. CLI log level setting is now fully effective.
• Enhanced debug logging in key areas for better diagnostics.

📚 Documentation & Project Files

• README.md: Overhauled with details on new features (drag & drop, new parsers), revised installation instructions (reflecting pyproject.toml), updated license information, and improved overall structure and formatting.
• SECURITY.md: Updated to be more user-friendly, clearly state the project's GPL-3.0 license, define support for the current main branch, and list security tools now in use (pip-audit, Bandit, Ruff).
• NOTICE.md: Created to provide proper attribution and license information for vendored code, particularly the MIT-licensed components from sd-prompt-reader.

🔬 Testing Notes (Brief)

• Manual testing performed for A1111/Forge PNGs, showing correct parsing and status reporting.
• Drag and drop functionality tested with single files and folders.
• Civitai ComfyUI JPGs and RuinedFooocus JPEGs now correctly identified by their respective parsers.
• (Add any other key tests you performed).

👀 Areas for Particular Review (Optional)

• Verification of __init__ signatures for NovelAI(info=...) and ComfyUI(info=...) calls within ImageDataReader.py (regarding width/height arguments) to ensure they match the actual definitions in those parsers.
• The robustness of the regex in metadata_parser.py's make_paired_str_dict for diverse A1111 settings strings (this is an ongoing refinement).
• The refactored ComfyUI graph traversal logic in vendored_sdpr/format/comfyui.py for correctness and completeness with varied workflows.

What's Changed

• 87 lint your damn code dusk by @duskfallcrew in 87 lint your damn code dusk #88

Full Changelog: 0.58.2.1...0.58.5

---

This discussion was created from the release Security Fix.