Don't allow dotfiles for /file=

CHANGELOG.md

@@ -6,7 +6,7 @@ No changes to highlight.
 
 ## Bug Fixes:
 
-No changes to highlight.
+- The `/file=` route no longer allows accessing dotfiles by [@akx](https://github.com/akx) in [PR 4302](https://github.com/gradio-app/gradio/pull/4302)
 
 ## Other Changes:
 

gradio/routes.py

@@ -326,7 +326,7 @@ async def file(path_or_url: str, request: fastapi.Request):
                 utils.is_in_or_equal(abs_path, blocked_path)
                 for blocked_path in blocks.blocked_paths
             )
-            if in_blocklist:
+            if in_blocklist or os.path.basename(abs_path).startswith("."):
                 raise HTTPException(403, f"File not allowed: {path_or_url}.")
 
             in_app_dir = utils.abspath(app.cwd) in abs_path.parents

test/test_routes.py

@@ -3,6 +3,7 @@
 import os
 import sys
 import tempfile
+from contextlib import closing
 from pathlib import Path
 from unittest.mock import patch
 
@@ -645,3 +646,17 @@ def test_orjson_serialization():
     response = test_client.get("/")
     assert response.status_code == 200
     demo.close()
+
+
+def test_file_route_does_not_allow_dot_paths(tmp_path):
+    dot_file = tmp_path / ".env"
+    dot_file.write_text("secret=1234")
+    subdir = tmp_path / "subdir"
+    subdir.mkdir()
+    sub_dot_file = subdir / ".env"
+    sub_dot_file.write_text("secret=1234")
+    with closing(gr.Interface(lambda s: s.name, gr.File(), gr.File())) as io:
+        app, _, _ = io.launch(prevent_thread_lock=True)
+        client = TestClient(app)
+        assert client.get(f"/file=.env").status_code == 403
+        assert client.get(f"/file=subdir/.env").status_code == 403