app.py

import gradio as gr

# Data with HuggingFace URL that redirects to cas-bridge-direct.xethub.hf.co
data_with_hf_url = [
    {
        "image": "https://huggingface.co/Norod78/Flux_1_Dev_LoRA_Paper-Cutout-Style/resolve/main/08a19840b6214b76b0607b2f9d5a7e28_63159b9d98124c008efb1d36446a615c.png",
        "title": "Test LoRA"
    }
]

def test_function(custom_input, state_data, gallery):
    print("This function will never be called due to SSRF validation error")
    return state_data, gr.update()

with gr.Blocks() as demo:
    # Initialize state with problematic HuggingFace URL
    state_with_urls = gr.State(data_with_hf_url)
    
    # Gallery initialized with the same URLs
    gallery = gr.Gallery(
        [(item["image"], item["title"]) for item in data_with_hf_url],
        label="Gallery with HF URLs",
        columns=1
    )
    
    custom_input = gr.Textbox(label="Custom input")
    button = gr.Button("Click me to trigger SSRF error")
    
    # This will fail with: ValueError: Hostname cas-bridge-direct.xethub.hf.co failed validation
    # The key is passing BOTH state_with_urls AND gallery as inputs
    button.click(
        test_function,
        inputs=[custom_input, state_with_urls, gallery],  # Both state and gallery with HF URLs
        outputs=[state_with_urls, gallery]  # Gallery also in outputs
    )

demo.launch()