Blocked Paths Fix (#10304)

* add code

* add changeset

* Fix test

* empty

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>

Author: freddyaboulton

.changeset/afraid-rats-guess.md

@@ -0,0 +1,5 @@
+---
+"gradio": minor
+---
+
+feat:Blocked Paths Fix

gradio/utils.py

@@ -1513,7 +1513,8 @@ def is_allowed_file(
     bool, Literal["in_blocklist", "allowed", "created", "not_created_or_allowed"]
 ]:
     in_blocklist = any(
-        is_in_or_equal(path, blocked_path) for blocked_path in blocked_paths
+        is_in_or_equal(str(path).lower(), str(blocked_path).lower())
+        for blocked_path in blocked_paths
     )
     if in_blocklist:
         return False, "in_blocklist"

test/test_routes.py

@@ -325,6 +325,24 @@ def test_allowed_and_blocked_paths(self):
         io.close()
         os.remove(tmp_file.name)
 
+    def test_blocked_path_case_insensitive(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            tmp_file = Path(temp_dir) / "blocked" / "test.txt"
+            tmp_file.parent.mkdir(parents=True, exist_ok=True)
+            tmp_file.touch()
+            io = gr.Interface(lambda s: s.name, gr.File(), gr.File())
+            app, _, _ = io.launch(
+                prevent_thread_lock=True,
+                allowed_paths=[temp_dir],
+                blocked_paths=[str(tmp_file.parent)],
+            )
+            client = TestClient(app)
+            file_response = client.get(
+                f"{API_PREFIX}/file={str(Path(temp_dir) / 'BLOCKED' / 'test.txt')}"
+            )
+            assert file_response.status_code == 403
+            io.close()
+
     def test_get_file_created_by_app(self, test_client):
         app, _, _ = gr.Interface(lambda s: s.name, gr.File(), gr.File()).launch(
             prevent_thread_lock=True