Add ComfyUI-xiaozhuguang to custom-node-list

[xiaozhuguang]

添加 ComfyUI-xiaozhuguang 插件到自定义节点列表。

小珠光插件提供丰富的UI增强功能，包括：

• 主题定制（渐变色、动画效果等）
• 编组管理（激光连线、批量开关等）
• 标题节点（预设、样式自定义等）
• 工作流管理（分类、搜索、收藏等）
• 连线动画（11种动画效果）
• 多种实用工具

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5c503345-9c2e-4822-b0c6-81d9605d504e

📥 Commits

Reviewing files that changed from the base of the PR and between c4ed394 and 873c82f.

📒 Files selected for processing (1)

• custom-node-list.json

---

📝 Walkthrough

Walkthrough

Added a custom-node-list.json entry for the 小珠光插件, including repository metadata, git-clone installation details, and a Chinese description of its UI enhancements.

Changes

Plugin catalog update

Layer / File(s)	Summary
Add plugin metadata custom-node-list.json	Registers the 小珠光插件 with author, title, repository reference, source URL, git-clone installation type, and feature description.

Possibly related PRs

• Comfy-Org/ComfyUI-Manager#3093 — Adds a closely related 小珠光插件 catalog entry.
• Comfy-Org/ComfyUI-Manager#3099 — Adds another plugin metadata entry to the same catalog.
• Comfy-Org/ComfyUI-Manager#3105 — Adds another custom-node-list.json plugin listing.

Suggested reviewers: ltdrdata, azornes

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request has been flagged as potential spam (promotional) by CodeRabbit slop detection and should be reviewed carefully.

[ltdrdata]

Thanks for the submission. I have to hold this — two blockers: unconfined path handling, and non-English node display names.

Security

Three sinks take attacker-controlled paths with no realpath+commonpath confinement or ../absolute rejection:

• XiaozhuguangImageSave (nodes/xzg_image_save.py:49) — free STRING output_path gets only strip("/\\") (doesn't reject ..), then os.makedirs + Image.save → path-traversal write.
• XiaozhuguangImageLoader (nodes/xzg_image_loader.py:291) — free STRING image_list resolved via unconfined get_annotated_filepath() (:29), then Image.opened and returned as IMAGE → arbitrary read.
• GET /xzg_image_loader_thumb (nodes/xzg_image_loader.py:108) — unauthenticated route resolves query filename (:117) through the same helper and returns the raw bytes → arbitrary read, remotely reachable with a single GET (no workflow needed).

Please confine all three to the intended input/output roots.

Localization

The default channel requires English node display names. NODE_DISPLAY_NAME_MAPPINGS (__init__.py:459) is almost entirely Chinese (~18 nodes), so the nodes surface in Chinese in the node search / canvas. Please make the default display names English.

For multilingual support, refer to the locale feature:
Comfy-Org/ComfyUI#6558

Once both are addressed, re-request review and I'll re-scan.