prevent directory traversal in the web UI

[bakkot]

It's probably not a good idea to run the web UI anywhere an untrusted device could access it. But even so, best not to have this sort of vulnerability.

You might plausibly want to restrict this further, e.g. by not exposing stuff like dream_log.txt.

[dagf2101]

Can you please explain what was the issue and how it is fixed ?

[bakkot]

The issue was that you could send the server a request like GET ./../whatever.txt and it would send you the file at stable-diffusion/../../whatever.txt, i.e., it allowed anyone to read any file off your system (as long as it could guess the MIME type, anyway). Browsers will generally normalize URLs like http://localhost/./../whatever.txt before sending, but you can still make such a request by talking to the server directly, for example using telnet.

The fix is to refuse to send files from outside the current directory.

[lstein]

Oh god. Thanks for catching that. I've been very focused on the GFPGAN stuff and am only now turning to the web server.