mirror/gradio
2
0
Fork 0
mirror of https://github.com/gradio-app/gradio.git synced 2025-04-18 12:50:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Prevent additional paths that can trigger credential leakage on Windows (#7598)

Browse Source 
* format

* add changeset

* docstring

* fix

* add changeset

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
This commit is contained in:
Abubakar Abid 2024-03-05 10:23:33 -08:00 committed by GitHub
parent 375bfd28d2
commit d3384cb926
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/weak-windows-itch.md Normal file
View File

@ -0,0 +1,5 @@
---
"gradio": patch
---
feat:Prevent additional paths that can trigger credential leakage on Windows

4
gradio/route_utils.py
View File

@ -598,9 +598,9 @@ def compare_passwords_securely(input_password: str, correct_password: str) -> bo
def starts_with_protocol(string: str) -> bool:
"""This regex matches strings that start with a scheme (one or more characters not including colon, slash, or space)
followed by ://, or start with just // or \\ as they are interpreted as SMB paths on Windows.
followed by ://, or start with just //, \\/, /\\, or \\ as they are interpreted as SMB paths on Windows.
"""
pattern = r"^(?:[a-zA-Z][a-zA-Z0-9+\-.]*://|//|\\\\)"
pattern = r"^(?:[a-zA-Z][a-zA-Z0-9+\-.]*://|//|\\\\|\\/|/\\)"
return re.match(pattern, string) is not None

4
test/test_routes.py
View File

@ -1146,6 +1146,10 @@ def test_compare_passwords_securely():
("//path", True),
("\\\\path", True),
("/usr/bin//test", False),
("/\\10.0.225.200/share", True),
("\\/10.0.225.200/share", True),
("/home//user", False),
("C:\\folder\\file", False),
],
)
def test_starts_with_protocol(string, expected):