Bugfix: .. in filename throwing error while loading in output. (#7795)

* Exclude filename while preventing path traversal

* add changeset

* add changeset

* Check if path1 is a file and use path1
parent to compare

* explicit

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
Co-authored-by: Freddy Boulton <alfonsoboulton@gmail.com>
Co-authored-by: Abubakar Abid <abubakar@huggingface.co>

.changeset/busy-things-relax.md

@@ -0,0 +1,5 @@
+---
+"gradio": patch
+---
+
+fix:Bugfix: `..` in filename throwing error while loading in output.

gradio/utils.py

@@ -1,4 +1,4 @@
-""" Handy utility functions. """
+"""Handy utility functions."""
 
 from __future__ import annotations
 
@@ -1006,13 +1006,16 @@ def is_in_or_equal(path_1: str | Path, path_2: str | Path):
     True if path_1 is a descendant (i.e. located within) path_2 or if the paths are the
     same, returns False otherwise.
     Parameters:
-        path_1: str or Path (should be a file)
-        path_2: str or Path (can be a file or directory)
+        path_1: str or Path (to file or directory)
+        path_2: str or Path (to file or directory)
     """
     path_1, path_2 = abspath(path_1), abspath(path_2)
     try:
-        if ".." in str(path_1.relative_to(path_2)):  # prevent path traversal
-            return False
+        relative_path = path_1.relative_to(path_2)
+        if str(relative_path) == ".":
+            return True
+        relative_path = path_1.parent.relative_to(path_2)
+        return ".." not in str(relative_path)
     except ValueError:
         return False
     return True

test/test_utils.py

@@ -423,6 +423,7 @@ def test_tex2svg_preserves_matplotlib_backend():
 def test_is_in_or_equal():
     assert is_in_or_equal("files/lion.jpg", "files/lion.jpg")
     assert is_in_or_equal("files/lion.jpg", "files")
+    assert is_in_or_equal("files/lion.._M.jpg", "files")
     assert not is_in_or_equal("files", "files/lion.jpg")
     assert is_in_or_equal("/home/usr/notes.txt", "/home/usr/")
     assert not is_in_or_equal("/home/usr/subdirectory", "/home/usr/notes.txt")