open-webui/backend/open_webui
Classic298 45f4a87e85
fix: bound extracted document metadata by the upload size limit by default (#29025)
"RAG_METADATA_MAX_VALUE_CHARS" ships unset, and unset means no bound at all, so the limit only protects the deployments that already knew to configure it. A small Office document is a zip archive, and one crafted to expand enormously during extraction can turn a few hundred kilobytes into gigabytes of metadata held in memory; uploading it a handful of times is enough to exhaust a server and take Open WebUI down with it.

When no explicit limit is configured, the bound now follows "RAG_FILE_MAX_SIZE" instead of being absent, on the reasoning that a document cannot legitimately carry more metadata than the file itself is allowed to be. That keeps the number from being an arbitrary guess: it is whatever the administrator already decided an upload may weigh. Setting "RAG_METADATA_MAX_VALUE_CHARS" explicitly still wins, and a deployment that leaves both unset is unchanged, which is the same posture the upload limit itself takes.

"RAG_FILE_MAX_SIZE" is in MB and is treated as unset when it is zero, matching how the document loader already reads it.
2026-08-25 15:50:27 -04:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal fix: apply RDS IAM token auth to the pgvector engine (#27754) 2026-08-24 07:35:19 -04:00
migrations fix: index the chat queries that make large SQLite instances unusable (#27663) 2026-08-23 16:11:54 -05:00
models refac 2026-08-25 14:35:22 -04:00
retrieval refac 2026-08-25 15:48:30 -04:00
routers refac 2026-08-25 13:18:38 -04:00
socket refac 2026-08-25 12:22:19 -04:00
static refac 2026-07-27 19:39:36 -04:00
storage refac 2026-07-31 17:41:14 -04:00
tools refac 2026-08-24 18:56:39 -04:00
utils perf: stop re-copying the response text on every stream save (#28821) 2026-08-25 15:41:54 -04:00
__init__.py perf: allow disabling websocket per-message-deflate (#28613) 2026-08-24 18:46:07 -04:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py refac: consolidate the web fetch address checks onto the request path (#27823) 2026-08-25 11:15:48 -04:00
constants.py refac: make the web search error message a plain constant (#28948) 2026-08-23 13:27:02 -04:00
env.py fix: bound extracted document metadata by the upload size limit by default (#29025) 2026-08-25 15:50:27 -04:00
events.py refac 2026-08-16 23:21:00 -07:00
functions.py fix: honor bypass_system_prompt on the pipe route (#28739) 2026-08-19 11:08:02 -07:00
main.py refac 2026-08-25 15:05:02 -04:00
tasks.py refac 2026-08-25 10:03:53 -04:00