mirror/gradio
2
0
Fork 0
mirror of https://github.com/gradio-app/gradio.git synced 2025-03-31 12:20:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Prevent file traversals (#6833)

Browse Source 
* prevent file traversal

* fix

* add changeset

* unit test

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
This commit is contained in:
Abubakar Abid 2023-12-18 14:30:22 -08:00 committed by GitHub
parent 992d540c3d
commit 1b9d4234d6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/tough-zoos-move.md Normal file
View File

@ -0,0 +1,5 @@
---
"gradio": minor
---
feat:Prevent file traversals

2
gradio/utils.py
View File

@ -932,7 +932,7 @@ def is_in_or_equal(path_1: str | Path, path_2: str | Path):
"""
path_1, path_2 = abspath(path_1), abspath(path_2)
try:
if str(path_1.relative_to(path_2)).startswith(".."): # prevent path traversal
if ".." in str(path_1.relative_to(path_2)): # prevent path traversal
return False
except ValueError:
return False

1
test/test_utils.py
View File

@ -403,6 +403,7 @@ def test_is_in_or_equal():
assert is_in_or_equal("/home/usr/notes.txt", "/home/usr/")
assert not is_in_or_equal("/home/usr/subdirectory", "/home/usr/notes.txt")
assert not is_in_or_equal("/home/usr/../../etc/notes.txt", "/home/usr/")
assert not is_in_or_equal("/safe_dir/subdir/../../unsafe_file.txt", "/safe_dir/")
@pytest.mark.parametrize(