🔒 [security fix] Restrict Gradio and FastAPI to localhost by default#4
Conversation
This commit addresses a security vulnerability where the Gradio and FastAPI interfaces were exposed to all network interfaces (0.0.0.0). Changes: - Modified `app.py` to bind Gradio to `127.0.0.1` by default. - Added support for `GRADIO_SERVER_NAME` environment variable to allow configuration in environments like Docker. - Updated `backend/app/config.py` to set the default backend host to `127.0.0.1`. - Updated `backend/.env.example` to reflect the new secure default. This ensures the application is secure by default while remaining configurable for containerized deployments. Co-authored-by: SarmaHighOnCode <218538054+SarmaHighOnCode@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🎯 What: The vulnerability fixed
The application previously bound its web interfaces (Gradio and FastAPI) to
0.0.0.0, making them accessible from any network interface on the host.Exposing these interfaces to the public internet or untrusted networks could lead to unauthorized access to the handwriting synthesis engine, potentially leading to resource exhaustion or exploitation of any further vulnerabilities in the application.
🛡️ Solution: How the fix addresses the vulnerability
The fix changes the default binding address to
127.0.0.1(localhost). This restricts access to the local machine only. For environments that require external access (like Docker or Hugging Face Spaces), the binding address can be explicitly configured via environment variables.PR created automatically by Jules for task 16310730726973963015 started by @SarmaHighOnCode