mirror/gradio
2
0
Fork 0
mirror of https://github.com/gradio-app/gradio.git synced 2025-03-31 12:20:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

Bugfix: .. in filename throwing error while loading in output. (#7795)

Browse Source 
* Exclude filename while preventing path traversal

* add changeset

* add changeset

* Check if path1 is a file and use path1
parent to compare

* explicit

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
Co-authored-by: Freddy Boulton <alfonsoboulton@gmail.com>
Co-authored-by: Abubakar Abid <abubakar@huggingface.co>
This commit is contained in:
Shubham raj 2024-03-26 00:57:42 +05:30 committed by GitHub
parent e0a8b7fa2c
commit 1c257f5ebc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/busy-things-relax.md Normal file
View File

@ -0,0 +1,5 @@
---
"gradio": patch
---
fix:Bugfix: `..` in filename throwing error while loading in output.

13
gradio/utils.py
View File

@ -1,4 +1,4 @@
""" Handy utility functions. """
"""Handy utility functions."""
from __future__ import annotations
@ -1006,13 +1006,16 @@ def is_in_or_equal(path_1: str | Path, path_2: str | Path):
True if path_1 is a descendant (i.e. located within) path_2 or if the paths are the
same, returns False otherwise.
Parameters:
path_1: str or Path (should be a file)
path_2: str or Path (can be a file or directory)
path_1: str or Path (to file or directory)
path_2: str or Path (to file or directory)
"""
path_1, path_2 = abspath(path_1), abspath(path_2)
try:
if ".." in str(path_1.relative_to(path_2)): # prevent path traversal
return False
relative_path = path_1.relative_to(path_2)
if str(relative_path) == ".":
return True
relative_path = path_1.parent.relative_to(path_2)
return ".." not in str(relative_path)
except ValueError:
return False
return True

1
test/test_utils.py
View File

@ -423,6 +423,7 @@ def test_tex2svg_preserves_matplotlib_backend():
def test_is_in_or_equal():
assert is_in_or_equal("files/lion.jpg", "files/lion.jpg")
assert is_in_or_equal("files/lion.jpg", "files")
assert is_in_or_equal("files/lion.._M.jpg", "files")
assert not is_in_or_equal("files", "files/lion.jpg")
assert is_in_or_equal("/home/usr/notes.txt", "/home/usr/")
assert not is_in_or_equal("/home/usr/subdirectory", "/home/usr/notes.txt")