Create app.py
Browse files
app.py
ADDED
@@ -0,0 +1,50 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
1 |
+
import gradio as gr
|
2 |
+
|
3 |
+
# Problematic URL that triggers the SSRF validation error
|
4 |
+
# This is a legitimate Hugging Face URL that should be allowed
|
5 |
+
problematic_url = "https://huggingface.co/Norod78/JojosoStyle-flux-lora/resolve/main/samples/1725217578243__000000000_0.jpg"
|
6 |
+
|
7 |
+
# Sample data with image URLs (similar to loras_state)
|
8 |
+
sample_data = [
|
9 |
+
{
|
10 |
+
"title": "Sample LoRA",
|
11 |
+
"image": problematic_url, # This URL causes the issue
|
12 |
+
"repo": "some/repo"
|
13 |
+
}
|
14 |
+
]
|
15 |
+
|
16 |
+
def dummy_function(text_input, state_data):
|
17 |
+
"""
|
18 |
+
This function should be called when button is clicked,
|
19 |
+
but the error occurs before it even executes.
|
20 |
+
"""
|
21 |
+
print("Function was called!") # This should appear in logs but doesn't
|
22 |
+
return f"Processed: {text_input}", state_data
|
23 |
+
|
24 |
+
# Create the interface
|
25 |
+
with gr.Blocks() as demo:
|
26 |
+
gr.Markdown("# Gradio SSRF Bug Reproduction")
|
27 |
+
gr.Markdown("Click the button below. You should see an error about hostname validation.")
|
28 |
+
|
29 |
+
# State containing URLs that trigger the issue
|
30 |
+
state_var = gr.State(sample_data)
|
31 |
+
|
32 |
+
# Simple text input
|
33 |
+
text_input = gr.Textbox(label="Enter some text", value="test")
|
34 |
+
|
35 |
+
# Output
|
36 |
+
output = gr.Textbox(label="Output")
|
37 |
+
|
38 |
+
# Button that triggers the error
|
39 |
+
button = gr.Button("Click me - this will fail")
|
40 |
+
|
41 |
+
# This should work fine, but fails with:
|
42 |
+
# ValueError: Hostname cas-bridge-direct.xethub.hf.co failed validation
|
43 |
+
button.click(
|
44 |
+
fn=dummy_function,
|
45 |
+
inputs=[text_input, state_var],
|
46 |
+
outputs=[output, state_var]
|
47 |
+
)
|
48 |
+
|
49 |
+
if __name__ == "__main__":
|
50 |
+
demo.launch()
|