Improve is_in_or_equal and fuzzer (#9341)

* improve fuzzer

* test case

* add changeset

* verify

* Update gradio/utils.py

Co-authored-by: Abubakar Abid <abubakar@huggingface.co>

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
Co-authored-by: Abubakar Abid <abubakar@huggingface.co>

.changeset/every-candies-sell.md

@@ -0,0 +1,5 @@
+---
+"gradio": minor
+---
+
+feat:Improve is_in_or_equal and fuzzer

gradio/utils.py

@@ -1057,13 +1057,10 @@ def is_in_or_equal(path_1: str | Path, path_2: str | Path) -> bool:
         path_1: str or Path (to file or directory)
         path_2: str or Path (to file or directory)
     """
-    path_1, path_2 = (
-        os.path.normpath(os.path.abspath(path_1)),
-        os.path.normpath(os.path.abspath(path_2)),
-    )
+    path_1, path_2 = abspath(path_1).resolve(), abspath(path_2).resolve()
     try:
-        relative_path = os.path.relpath(path_1, path_2)
-        return not relative_path.startswith("..")
+        path_1.relative_to(path_2)
+        return True
     except ValueError:
         return False
 

test/test_utils.py

@@ -373,22 +373,24 @@ def test_is_in_or_equal():
     assert not is_in_or_equal("/home/usr/subdirectory", "/home/usr/notes.txt")
     assert not is_in_or_equal("/home/usr/../../etc/notes.txt", "/home/usr/")
     assert not is_in_or_equal("/safe_dir/subdir/../../unsafe_file.txt", "/safe_dir/")
-    assert is_in_or_equal("//tmp/asd/", "/tmp")
+    assert is_in_or_equal("//foo/asd/", "/foo")
+    assert is_in_or_equal("//foo/..a", "//foo")
+    assert is_in_or_equal("//foo/..²", "/foo")
 
 
 def create_path_string():
     return st.lists(
         st.one_of(
             st.text(
-                alphabet="abcd",
+                alphabet="ab@1/(",
                 min_size=1,
             ),
             st.just(".."),
             st.just("."),
         ),
         min_size=1,
         max_size=10,  # Limit depth to avoid excessively long paths
-    ).map(lambda x: os.path.join(*x))
+    ).map(lambda x: os.path.join(*x).replace("(", ".."))
 
 
 def create_path_list():