Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Warn against Falsy credentials #8683

Merged
merged 4 commits into from
Jul 2, 2024
Merged

Conversation

Paillat-dev
Copy link
Contributor

Allowing Falsy auth credentials will cause problems later, for example in hmac.compare_digest(input_password.encode(), correct_password.encode()) as NoneType has no encode method. Moreover, allowing empty passwords would make no sense from a security point of view.

Let me know if any changes are required.

@gradio-pr-bot
Copy link
Collaborator

gradio-pr-bot commented Jul 2, 2024

🪼 branch checks and previews

Name Status URL
Spaces ready! Spaces preview
Website ready! Website preview
🦄 Changes detecting...

Install Gradio from this PR

pip install https://gradio-builds.s3.amazonaws.com/1c662c46cbc57c150e1ea262b24f537d7b473212/gradio-4.37.2-py3-none-any.whl

Install Gradio Python Client from this PR

pip install "gradio-client @ git+https://github.com/gradio-app/gradio@1c662c46cbc57c150e1ea262b24f537d7b473212#subdirectory=client/python"

Install Gradio JS Client from this PR

npm install https://gradio-builds.s3.amazonaws.com/1c662c46cbc57c150e1ea262b24f537d7b473212/gradio-client-1.2.1.tgz

@Paillat-dev Paillat-dev marked this pull request as draft July 2, 2024 16:13
@Paillat-dev Paillat-dev marked this pull request as ready for review July 2, 2024 16:36
@abidlabs
Copy link
Member

abidlabs commented Jul 2, 2024

Thanks @Paillat-dev I would suggest raising a warning when a none or empty credential is passed in instead of an error -- a lot of times, users are simply prototyping quickly with auth and we don't want to break those workflows

Allowing Falsy auth credentials will cause problems later, for example in `hmac.compare_digest(input_password.encode(), correct_password.encode())` as NoneType has no `encode` method. Moreover, allowing empty passwords would make no sense from a security point of view.
@Paillat-dev
Copy link
Contributor Author

Sure, I changed it.

@Paillat-dev Paillat-dev changed the title fix(auth): Disallow Falsy credentials fix(auth): Warn against Falsy credentials Jul 2, 2024
@abidlabs abidlabs changed the title fix(auth): Warn against Falsy credentials Warn against Falsy credentials Jul 2, 2024
Copy link
Member

@abidlabs abidlabs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM @Paillat-dev thanks for the contribution!

@gradio-pr-bot
Copy link
Collaborator

gradio-pr-bot commented Jul 2, 2024

🦄 change detected

This Pull Request includes changes to the following packages.

Package Version
gradio patch
  • Maintainers can select this checkbox to manually select packages to update.

With the following changelog entry.

Warn against Falsy credentials

Maintainers or the PR author can modify the PR title to modify this entry.

Something isn't right?

  • Maintainers can change the version label to modify the version bump.
  • If the bot has failed to detect any changes, or if this pull request needs to update multiple packages to different versions or requires a more comprehensive changelog entry, maintainers can update the changelog file directly.

@abidlabs abidlabs added the v: patch A change that requires a patch release label Jul 2, 2024
@abidlabs abidlabs merged commit a92c3e8 into gradio-app:main Jul 2, 2024
7 checks passed
@Paillat-dev Paillat-dev deleted the patch-1 branch July 2, 2024 18:47
@pngwn pngwn mentioned this pull request Jul 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
v: patch A change that requires a patch release
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants