Prevent file traversals

[abidlabs]

Internal thread

Closes: #6816

[gradio-pr-bot]

🪼 branch checks and previews

•	Name	Status	URL
	Spaces	ready!	Spaces preview
	Website	ready!	Website preview
🦄	Changes	detected!	Details

---

Install Gradio from this PR

pip install https://gradio-builds.s3.amazonaws.com/6df1e846352c26135ee970ec7d6bc772ea8b33d3/gradio-4.10.0-py3-none-any.whl

Install Gradio Python Client from this PR

pip install "gradio-client @ git+https://github.com/gradio-app/gradio@6df1e846352c26135ee970ec7d6bc772ea8b33d3#subdirectory=client/python"

[gradio-pr-bot]

🦄 change detected

This Pull Request includes changes to the following packages.

Package	Version
gradio	minor

• Maintainers can select this checkbox to manually select packages to update.

With the following changelog entry.

Prevent file traversals

Maintainers or the PR author can modify the PR title to modify this entry.

Something isn't right?

• Maintainers can change the version label to modify the version bump.
• If the bot has failed to detect any changes, or if this pull request needs to update multiple packages to different versions or requires a more comprehensive changelog entry, maintainers can update the changelog file directly.

[freddyaboulton]

Thanks @abidlabs !

[freddyaboulton]

Would be nice to write a unit test for this!

[abidlabs]

I tried to write a unit test but for some reason I can't reproduce this behavior with fastapi's test client. Only curl seems to have this effect (and only if you pass in --path-as-is flag)

[abidlabs]

Apparently due to this PR urllib3/urllib3#1487. Let me see if I can write a unit test a different way

[abidlabs]

Ok added a quick unit test. Thanks for the review @freddyaboulton! Will merge after CI is green