Update utils.py

utils.py

@@ -30,7 +30,7 @@ from urllib3.util import Retry
 import shutil
 import subprocess
 import json
-import html as _html
+from html import escape as esc
 
 IS_ZERO_GPU = bool(os.getenv("SPACES_ZERO_GPU"))
 USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0'
@@ -42,32 +42,32 @@ MODEL_ARCH = {
 
 
 def validate_url(url: str) -> str:
-    """Validate URL protocol and block SSRF (localhost, private & cloud metadata IPs)."""
+    """Validate URL protocol and host."""
     url = url.strip()
     if not url:
         raise ValueError("URL cannot be empty.")
 
     parsed = urllib.parse.urlparse(url)
-    if parsed.scheme not in ("http", "https"):
-        raise ValueError(f"Invalid protocol '{parsed.scheme}'. Only HTTP/HTTPS are allowed.")
+    if parsed.scheme != "https":
+        raise ValueError(f"Invalid protocol '{parsed.scheme}'. Only HTTPS is allowed.")
 
     hostname = (parsed.hostname or "").lower()
     if not hostname:
         raise ValueError("Invalid URL: missing hostname.")
 
-    # SSRF Protection: Block loopback and local hosts
+    # Restrict local and internal endpoints
     if hostname in ("localhost", "0.0.0.0", "127.0.0.1", "::1"):
-        raise ValueError("Access to local/loopback address is blocked.")
+        raise ValueError("Restricted address.")
 
-    # SSRF Protection: Block private and link-local / cloud metadata IPs (e.g. 169.254.169.254)
+    # Restrict private IP addresses
     try:
         ip = ipaddress.ip_address(hostname)
         if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
-            raise ValueError(f"Access to internal IP ({hostname}) is blocked.")
+            raise ValueError(f"Access to ({hostname}) is blocked.")
     except ValueError:
         pass  # Standard domain name
 
-    # Normalize Civitai domain alias
+    # Normalize domain alias
     if hostname == "civitai.red" or hostname.endswith(".civitai.red"):
         url = url.replace("civitai.red", "civitai.com")
 
@@ -180,9 +180,6 @@ class LoraHeaderInformation:
         Return a compact HTML snippet (string) showing the parsed info
         in a small font. Values are HTML-escaped.
         """
-        # helper to escape
-        esc = _html.escape
-
         rows = [
             ("Title", esc(str(self.title))),
             ("Author", esc(str(self.author))),
@@ -415,7 +412,6 @@ def download_things(directory, url, hf_token="", civitai_api_key="", romanize=Fa
     if not url:
         return None
 
-    # SSRF & protocol validation
     try:
         url = validate_url(url)
     except Exception as e:
@@ -531,7 +527,7 @@ def get_my_lora(link_url, romanize):
     new_lora_model_list = new_lora_model_list + DIFFUSERS_FORMAT_LORAS
     msg_lora = "Downloaded"
     if l_name:
-        msg_lora += f": <b>{l_name}</b>"
+        msg_lora += f": <b>{escape_html(os.path.basename(l_name))}</b>"
         print(msg_lora)
 
     try:
@@ -776,4 +772,6 @@ def html_template_message(msg):
 
 def escape_html(text):
     """Escapes HTML special characters in the input text."""
-    return text.replace("<", "&lt;").replace(">", "&gt;").replace("\n", "<br>")
+    if text is None:
+        return ""
+    return esc(str(text), quote=True).replace("\n", "<br>")