From fa8461be9de417a5b84322de116f02157a235a7e Mon Sep 17 00:00:00 2001
From: onekum <55006697+onekum@users.noreply.github.com>
Date: Mon, 10 Apr 2023 09:21:43 -0400
Subject: [PATCH 1/2] Restrict browse from accessing local files

---
 scripts/browse.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/browse.py b/scripts/browse.py
index c15214e7..4a73d923 100644
--- a/scripts/browse.py
+++ b/scripts/browse.py
@@ -11,6 +11,10 @@ def scrape_text(url):
     if not url.startswith('http'):
         return "Error: Invalid URL"
     
+    # Restrict access to local files
+    if url.startswith('file://') or url.startswith('file://localhost'):
+        return "Error: Access to local files is restricted"
+    
     try:
         response = requests.get(url, headers=cfg.user_agent_header)
     except requests.exceptions.RequestException as e:
@@ -126,4 +130,4 @@ def summarize_text(text, question):
         max_tokens=300,
     )
 
-    return final_summary
\ No newline at end of file
+    return final_summary

From b60c7518b0640ae224f989a2cd964b37e0ca90bf Mon Sep 17 00:00:00 2001
From: onekum <55006697+onekum@users.noreply.github.com>
Date: Mon, 10 Apr 2023 12:10:28 -0400
Subject: [PATCH 2/2] Rework local file address blocks

add `def check_local_file_access`, which defines and checks for local file address prefixes; use it to restrict access
---
 scripts/browse.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/scripts/browse.py b/scripts/browse.py
index 4a73d923..09f376a7 100644
--- a/scripts/browse.py
+++ b/scripts/browse.py
@@ -5,6 +5,11 @@ from llm_utils import create_chat_completion
 
 cfg = Config()
 
+# Define and check for local file address prefixes
+def check_local_file_access(url):
+    local_prefixes = ['file:///', 'file://localhost', 'http://localhost', 'https://localhost']
+    return any(url.startswith(prefix) for prefix in local_prefixes)
+
 def scrape_text(url):
     """Scrape text from a webpage"""
     # Most basic check if the URL is valid:
@@ -12,7 +17,7 @@ def scrape_text(url):
         return "Error: Invalid URL"
     
     # Restrict access to local files
-    if url.startswith('file://') or url.startswith('file://localhost'):
+    if check_local_file_access(url):
         return "Error: Access to local files is restricted"
     
     try: