fix: malformed WEB_FETCH_FILTER_LIST entry blocking all web fetches (#26910)

Docker compose list-form environment syntax passes quotes through verbatim, so WEB_FETCH_FILTER_LIST="" reaches the backend as two literal quote characters rather than an empty string. Config parsing turned that into the filter entry '""', which has no "!" prefix and therefore landed in the allow list. A non-empty allow list requires every host to match one of its entries, and a quotes-only pattern can never match a hostname, so every fetch_url and web loader request was rejected with "URL blocked by filter list" and surfaced to the user as "The URL you provided is invalid".

get_allow_block_lists now strips surrounding quote characters from each entry and drops entries that are empty after normalisation. Quoted but otherwise valid entries such as "example.com" or !"example.com" now behave as their unquoted forms, and garbage entries no longer convert the default blocklist into a match-nothing allowlist that blocks everything.

Fixes #26908

backend/open_webui/utils/misc.py

@@ -29,18 +29,26 @@ def deep_update(d, u):
     return d
 
 
+def _strip_filter_entry(entry):
+    # Compose list-form env syntax passes surrounding quotes through verbatim
+    return (entry or '').strip().strip('"\'').strip()
+
+
 def get_allow_block_lists(filter_list):
     allow_list = []
     block_list = []
 
-    if filter_list:
-        for d in filter_list:
-            if d.startswith('!'):
-                # Domains starting with "!" → blocked
-                block_list.append(d[1:].strip())
-            else:
-                # Domains starting without "!" → allowed
-                allow_list.append(d.strip())
+    for raw_entry in filter_list or []:
+        entry = _strip_filter_entry(raw_entry)
+        is_blocked = entry.startswith('!')
+        if is_blocked:
+            entry = _strip_filter_entry(entry[1:])
+        if not entry:
+            continue
+        if is_blocked:
+            block_list.append(entry)
+        else:
+            allow_list.append(entry)
 
     return allow_list, block_list