scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-10-08 03:08:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix: constrain relative paths to known-safe prefixes

Browse source 
Accepting any relative path starting with / allowed a user to set
their profile_image_url to an arbitrary internal GET endpoint. When
another user (e.g. an admin) views that profile, the browser fires
the GET with the viewer's session cookies — an authenticated GET
trigger surface.

Constrain to known-safe prefixes (/api/v1/users/, /static/) and
exact matches (/user.png, /favicon.png) which are the only relative
paths OWUI itself generates.
This commit is contained in:
DrMelone 2026-04-03 22:40:20 +02:00
parent 90c676481d
commit 8dd015368c
1 changed files with 26 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
backend/open_webui/utils/validate.py
View file

@ -10,6 +10,21 @@ _SAFE_DATA_URI_RE = re.compile(
r'^data:image/(png|jpeg|gif|webp);base64,', re.IGNORECASE
)
# Relative path prefixes that are safe to accept as profile image URLs.
# These are the only patterns OWUI itself generates; arbitrary relative
# paths are rejected to prevent authenticated GET triggers against
# internal endpoints when other users view a profile.
_SAFE_RELATIVE_PATH_PREFIXES = (
'/api/v1/users/', # OWUI-generated profile image routes
'/static/', # Static assets served by the frontend
)
# Exact relative paths accepted (default avatars).
_SAFE_RELATIVE_PATHS = frozenset({
'/user.png',
'/favicon.png',
})
def validate_profile_image_url(url: str) -> str:
"""
@ -17,21 +32,23 @@ def validate_profile_image_url(url: str) -> str:
Allowed formats:
- Empty string (falls back to default avatar)
- Relative paths starting with ``/`` (internal assets and API routes)
- Known-safe relative paths (default avatars, static assets,
and OWUI profile image API routes)
- ``http://`` and ``https://`` URLs with a valid host
- ``data:image/{png,jpeg,gif,webp};base64,...`` URIs
All other schemes (javascript:, file:, ftp:, etc.) are rejected.
SVG data URIs are rejected because SVG can contain embedded scripts.
Arbitrary relative paths are rejected to prevent authenticated GET
requests against internal endpoints.
"""
if not url:
return url
# Relative paths: covers /user.png, /static/favicon.png,
# /api/v1/users/{id}/profile/image, and any future internal routes.
# Exclude scheme-relative URLs (//host/path) which browsers resolve
# against the current protocol.
if url.startswith('/') and not url.startswith('//'):
# Known-safe relative paths generated by OWUI itself.
if url in _SAFE_RELATIVE_PATHS:
return url
if any(url.startswith(prefix) for prefix in _SAFE_RELATIVE_PATH_PREFIXES):
return url
# urlparse normalises the scheme to lowercase, giving us
@ -55,7 +72,8 @@ def validate_profile_image_url(url: str) -> str:
return url
raise ValueError(
'Invalid profile image URL: must be a relative path, an HTTP(S) URL '
'with a host, or a data:image URI (png/jpeg/gif/webp).'
'Invalid profile image URL: must be a known internal path, '
'an HTTP(S) URL with a host, or a data:image URI (png/jpeg/gif/webp).'
)