Tighten CORS rules #7503

abidlabs · 2024-02-21T18:27:32Z

To prevent malicious 3rd party websites from making requests to Gradio applications running locally, this PR tightens the CORS rules around Gradio applications. In particular, based on @XciD's suggestion: it checks to see if the host header is localhost (or one of its aliases) and if so, it requires the origin header (if present) to be localhost (or one of its aliases) as well.

To test this, you can start running any Gradio app, e.g. this one, locally:

import gradio as gr

with gr.Blocks() as demo:
    t1 = gr.Textbox()
    demo.load(lambda :"Hello", None, t1)
    
demo.launch()

And then open up different websites in your browser and simulate requests from them using the Inspector console, e.g.:

fetch('http://localhost:7860/config')
  .then(response => {
    if (!response.ok) {
      throw new Error('Network response was not ok');
    }
    return response.json(); // or response.text() if the response is not in JSON format
  })
  .then(data => {
    console.log(data); // This will display the response in the console
  })
  .catch(error => {
    console.error('There has been a problem with your fetch operation:', error);
  });

If you make the request from a website on localhost, the request should go through, but if you make the request while a different webpage is loaded, it should be blocked.

I also installed this PR in this Space: https://huggingface.co/spaces/abidlabs/test-cors, and confirmed that:

The Client works with it:

from gradio_client import Client

client = Client("abidlabs/test-cors")
client.predict("Hello")

Embedding with an iFrame works:

<iframe
	src="https://abidlabs-test-cors.hf.space"
	frameborder="0"
	width="850"
	height="450"
></iframe>

Embedding with a web component NOW works (!):

<html>
<script
	type="module"
	src="https://gradio.s3-us-west-2.amazonaws.com/4.19.1/gradio.js"
></script>

<gradio-app src="https://abidlabs-test-cors.hf.space"></gradio-app>
</html>

gradio-pr-bot · 2024-02-21T18:28:10Z

🪼 branch checks and previews

•	Name	Status	URL
	Spaces	ready!	Spaces preview
	Website	ready!	Website preview
🦄	Changes	detected!	Details

Install Gradio from this PR

pip install https://gradio-builds.s3.amazonaws.com/01a39bf774b6c215a0a29220b576bb40329c81e6/gradio-4.19.1-py3-none-any.whl

Install Gradio Python Client from this PR

pip install "gradio-client @ git+https://github.com/gradio-app/gradio@01a39bf774b6c215a0a29220b576bb40329c81e6#subdirectory=client/python"

gradio-pr-bot · 2024-02-21T18:28:19Z

🦄 change detected

This Pull Request includes changes to the following packages.

Package	Version
`gradio`	`patch`

Maintainers can select this checkbox to manually select packages to update.

With the following changelog entry.

Tighten CORS rules

Maintainers or the PR author can modify the PR title to modify this entry.

Something isn't right?

Maintainers can change the version label to modify the version bump.
If the bot has failed to detect any changes, or if this pull request needs to update multiple packages to different versions or requires a more comprehensive changelog entry, maintainers can update the changelog file directly.

gradio/route_utils.py

PinkDraconian · 2024-02-21T20:02:28Z

This fix looks great. Thank you for the resolution.
Would you also be able to "accept" my report? That way the process over there moves along.

gradio/route_utils.py

akx

Wouldn't this be served by just setting allow_origin_regex for CORSMiddleware?

abidlabs · 2024-02-22T16:21:13Z

Wouldn't this be served by just setting allow_origin_regex for CORSMiddleware?

I don't believe so, no. We want to apply CORS only if the host is localhost (i.e. the app is running locally), which is not something that allow_origin_regex allows us to do

pngwn

From my testing this works great! Thanks @abidlabs!

abidlabs · 2024-02-22T19:54:40Z

Thank you @whitphx @akx @pngwn for the reviews, and for @PinkDraconian for reporting the original issue!

tighten cors rules

5f914b2

add changeset

c16c55b

abidlabs added 3 commits February 21, 2024 10:34

cors policy

03b36d6

Merge branch 'cors' of github.com:gradio-app/gradio into cors

68e24ff

cors

c8397f5

abidlabs added the v: patch A change that requires a patch release label Feb 21, 2024

add changeset

41b0366

abidlabs marked this pull request as ready for review February 21, 2024 18:41

abidlabs requested review from whitphx, aliabid94, aliabd, dawoodkhan82, pngwn, hannahblair, hysts and freddyaboulton February 21, 2024 18:41

abidlabs added 2 commits February 21, 2024 10:45

lint

b6c9e69

Merge branch 'cors' of github.com:gradio-app/gradio into cors

915e39e

akx reviewed Feb 21, 2024

View reviewed changes

gradio/route_utils.py Outdated Show resolved Hide resolved

gradio/route_utils.py Outdated Show resolved Hide resolved

gradio/route_utils.py Outdated Show resolved Hide resolved

abidlabs added 8 commits February 21, 2024 14:24

changes

3d8c4f8

changes

c077ca8

changes

ad54cf0

Merge branch 'main' into cors

38e39ee

logging

ddad9b7

Merge branch 'cors' of github.com:gradio-app/gradio into cors

5af640c

add null

5b40ec4

changes

dcfe0a1

abidlabs added 4 commits February 21, 2024 15:45

changes

9d2995d

options

cd12601

options

b8a5758

Merge branch 'main' into cors

673ccf3

whitphx reviewed Feb 22, 2024

View reviewed changes

gradio/route_utils.py Outdated Show resolved Hide resolved

gradio/route_utils.py Show resolved Hide resolved

gradio/route_utils.py Outdated Show resolved Hide resolved

whitphx reviewed Feb 22, 2024

View reviewed changes

gradio/route_utils.py Outdated Show resolved Hide resolved

akx reviewed Feb 22, 2024

View reviewed changes

gradio/route_utils.py Outdated Show resolved Hide resolved

akx reviewed Feb 22, 2024

View reviewed changes

abidlabs added 8 commits February 22, 2024 08:28

safe changes

3d7f5fe

let browser enforce cors

2d25696

Merge branch 'main' into cors

483f922

clean

72d8216

route utils

441190d

fix

073bfc2

fix test

54e1196

fix

01a39bf

pngwn approved these changes Feb 22, 2024

View reviewed changes

abidlabs merged commit 84802ee into main Feb 22, 2024
7 checks passed

abidlabs deleted the cors branch February 22, 2024 19:54

pngwn mentioned this pull request Feb 22, 2024

chore: update versions #7463

Merged

abidlabs mentioned this pull request May 20, 2024

Status of CVE-2023-41626? / Security contact e-mail not working? #8337

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tighten CORS rules #7503

Tighten CORS rules #7503

abidlabs commented Feb 21, 2024 •

edited

gradio-pr-bot commented Feb 21, 2024 •

edited

gradio-pr-bot commented Feb 21, 2024 •

edited

Something isn't right?

PinkDraconian commented Feb 21, 2024

akx left a comment

abidlabs commented Feb 22, 2024

pngwn left a comment

abidlabs commented Feb 22, 2024

Tighten CORS rules #7503

Tighten CORS rules #7503

Conversation

abidlabs commented Feb 21, 2024 • edited

gradio-pr-bot commented Feb 21, 2024 • edited

🪼 branch checks and previews

gradio-pr-bot commented Feb 21, 2024 • edited

🦄 change detected

This Pull Request includes changes to the following packages.

With the following changelog entry.

Something isn't right?

PinkDraconian commented Feb 21, 2024

akx left a comment

Choose a reason for hiding this comment

abidlabs commented Feb 22, 2024

pngwn left a comment

Choose a reason for hiding this comment

abidlabs commented Feb 22, 2024

abidlabs commented Feb 21, 2024 •

edited

gradio-pr-bot commented Feb 21, 2024 •

edited

gradio-pr-bot commented Feb 21, 2024 •

edited