Block /file= filepaths that could expose credentials on Windows
#7444
Conversation
🪼 branch checks and previews
Install Gradio from this PR pip install https://gradio-builds.s3.amazonaws.com/24bd0909a1904ebdb756087ed4f5ae8c47212477/gradio-4.19.0-py3-none-any.whlInstall Gradio Python Client from this PR pip install "gradio-client @ git+https://github.com/gradio-app/gradio@24bd0909a1904ebdb756087ed4f5ae8c47212477#subdirectory=client/python" |
🦄 change detectedThis Pull Request includes changes to the following packages.
With the following changelog entry.
Maintainers or the PR author can modify the PR title to modify this entry.
|
abidlabs
requested review from
aliabid94,
aliabd,
dawoodkhan82,
pngwn,
freddyaboulton,
whitphx and
hysts
| @@ -720,25 +726,6 @@ def test_orjson_serialization(): | |||
| demo.close() | |||
|
|
|||
|
|
|||
| def test_file_route_does_not_allow_dot_paths(tmp_path): | |||
There was a problem hiding this comment.
We don't need a dedicated test suite for this since this is no longer a special case (we simply block all files in the working directory)
| @@ -428,12 +428,18 @@ async def file(path_or_url: str, request: fastapi.Request): | |||
| return RedirectResponse( | |||
| url=path_or_url, status_code=status.HTTP_302_FOUND | |||
| ) | |||
|
|
|||
| invalid_prefixes = ["//", "file://", "ftp://", "sftp://", "smb://"] | |||
There was a problem hiding this comment.
I believe checking whether or not abs_path exists will also fix the issue and it doesn't involve hardcoding this list of prefixes?
There was a problem hiding this comment.
So I'm not sure totally sure but it seems like any file operation on Windows could leak credentials
There was a problem hiding this comment.
Do we care about ipfs urls here too?
There was a problem hiding this comment.
Probably so I don't know that much about them, but let me rewrite them to prevent any protocols except for http/https
…ls on Windows) more general (#7453) * test routes * chagne * add changeset * add changeset * type fixes * fix typing issues * typed dict --------- Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
No description provided.