Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing

@@ -0,0 +1,6 @@
+---
+"gradio": patch
+"gradio_client": patch
+---
+
+fix:Validate proxy url host

@@ -215,7 +215,10 @@ def document_fn(fn: Callable, cls) -> tuple[str, list[dict], dict, str | None]:
         return_docs = {}
     else:
         return_doc_text = "\n".join(returns)
-        return_docs = {"annotation": signature.return_annotation, "doc": return_doc_text}
+        return_docs = {
+            "annotation": signature.return_annotation,
+            "doc": return_doc_text,
+        }
     examples_doc = "\n".join(examples) if len(examples) > 0 else None
     return description_doc, parameter_docs, return_docs, examples_doc
 

@@ -1206,7 +1206,9 @@ def from_config(
         config = copy.deepcopy(config)
         components_config = config["components"]
         original_mapping: dict[int, Block] = {}
-        proxy_urls = {proxy_url}
+        proxy_urls: set[str] = set()
+        if httpx.URL(proxy_url).host.endswith(".hf.space"):
+            proxy_urls.add(proxy_url)
 
         def get_block_instance(id: int) -> Block:
             for block_config in components_config:
@@ -1230,7 +1232,10 @@ def get_block_instance(id: int) -> Block:
 
             block_proxy_url = block_config["props"]["proxy_url"]
             block.proxy_url = block_proxy_url
-            proxy_urls.add(block_proxy_url)
+            # Only add proxy URLs that point to known Hugging Face Space
+            # hosts to prevent SSRF via malicious configs.
+            if httpx.URL(block_proxy_url).host.endswith(".hf.space"):
+                proxy_urls.add(block_proxy_url)
             if (
                 _selectable := block_config["props"].pop("_selectable", None)
             ) is not None:

@@ -132,7 +132,7 @@ def preprocess(
         Parameters:
             payload: Dict of base image and list of annotations.
         Returns:
-            Passes its value as a `tuple` consisting of: 
+            Passes its value as a `tuple` consisting of:
             - `str` filepath to a base image
             - `list` of annotations.
             -- Each annotation itself is a `tuple` of a mask (as a `str` filepath to image) and a `str` label.
@@ -155,7 +155,7 @@ def postprocess(
     ) -> AnnotatedImageData | None:
         """
         Parameters:
-            value: Expects a tuple consisting of a base image and list of annotations: a `tuple[Image, list[Annotation]]`. 
+            value: Expects a tuple consisting of a base image and list of annotations: a `tuple[Image, list[Annotation]]`.
                 - The `Image` itself can be `str` filepath, `numpy.ndarray`, or `PIL.Image`.
                 - Each `Annotation` is a `tuple[Mask, str]`.
                 -- The `Mask` can be either a `tuple` of 4 `int`'s representing the bounding box coordinates (x1, y1, x2, y2), or 0-1 confidence mask in the form of a `numpy.ndarray` of the same shape as the image.

@@ -367,9 +367,12 @@ def build_proxy_request(self, url_path):
         )
         if not is_safe_url:
             raise PermissionError("This URL cannot be proxied.")
-        is_hf_url = url.host.endswith(".hf.space")
+        # Only allow proxying to Hugging Face Space URLs to prevent SSRF
+        # via malicious proxy_url values in untrusted configs.
+        if not url.host.endswith(".hf.space"):
+            raise PermissionError("This URL cannot be proxied.")
         headers = {}
-        if Context.token is not None and is_hf_url:
+        if Context.token is not None:
             headers["Authorization"] = f"Bearer {Context.token}"
         rp_req = client.build_request("GET", url, headers=headers)
         return rp_req

@@ -633,8 +633,32 @@ def test_proxy_does_not_leak_hf_token_externally(self):
             "https://gradio-tests-test-loading-examples-private.hf.space/file=Bunny.obj"
         )
         assert "authorization" in dict(r.headers)
-        r = app.build_proxy_request("https://google.com")
-        assert "authorization" not in dict(r.headers)
+        with pytest.raises(PermissionError):
+            app.build_proxy_request("https://google.com")
+
+    def test_proxy_rejects_non_hf_space_urls(self):
+        """Proxy should reject non-.hf.space URLs even if they are in proxy_urls,
+        to prevent SSRF via malicious proxy_url injection in configs."""
+        app = routes.App()
+        interface = gr.Interface(lambda x: x, "text", "text")
+        interface.proxy_urls = {
+            "https://gradio-tests-test-loading-examples-private.hf.space",
+            "http://169.254.169.254",
+            "http://internal-service.local",
+        }
+        app.configure_app(interface)
+        # .hf.space URL should work
+        app.build_proxy_request(
+            "https://gradio-tests-test-loading-examples-private.hf.space/file=Bunny.obj"
+        )
+        # AWS metadata endpoint should be blocked
+        with pytest.raises(PermissionError):
+            app.build_proxy_request(
+                "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
+            )
+        # Internal service should be blocked
+        with pytest.raises(PermissionError):
+            app.build_proxy_request("http://internal-service.local/admin")
 
     def test_can_get_config_that_includes_non_pickle_able_objects(self):
         my_dict = {"a": 1, "b": 2, "c": 3}