Prevent file traversals (#6833)

* prevent file traversal

* fix

* add changeset

* unit test

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>

.changeset/tough-zoos-move.md

@@ -0,0 +1,5 @@
+---
+"gradio": minor
+---
+
+feat:Prevent file traversals

gradio/utils.py

@@ -932,7 +932,7 @@ def is_in_or_equal(path_1: str | Path, path_2: str | Path):
     """
     path_1, path_2 = abspath(path_1), abspath(path_2)
     try:
-        if str(path_1.relative_to(path_2)).startswith(".."):  # prevent path traversal
+        if ".." in str(path_1.relative_to(path_2)):  # prevent path traversal
             return False
     except ValueError:
         return False

test/test_utils.py

@@ -403,6 +403,7 @@ def test_is_in_or_equal():
     assert is_in_or_equal("/home/usr/notes.txt", "/home/usr/")
     assert not is_in_or_equal("/home/usr/subdirectory", "/home/usr/notes.txt")
     assert not is_in_or_equal("/home/usr/../../etc/notes.txt", "/home/usr/")
+    assert not is_in_or_equal("/safe_dir/subdir/../../unsafe_file.txt", "/safe_dir/")
 
 
 @pytest.mark.parametrize(