open-webui/backend/open_webui
Classic298 7ef0530b24
fix: handle urllib3-future 4-element socket options in SSRF-safe web loader (#26796)
_ssrf_safe_new_conn unpacks each entry of self.socket_options straight into socket.setsockopt(), which accepts exactly 3 positional arguments. urllib3-future, a drop-in fork that shadows the urllib3 package whenever it is installed (for example as a dependency of niquests pulled in through a tool or function's requirements), declares its default socket options with a per-protocol 4th element: [(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1, "tcp")]. Its own _set_socket_options() strips that element before calling setsockopt(), but our override does not, so with urllib3-future present every synchronous web fetch (fetch_url, web search loading) fails on connect with "TypeError: setsockopt() takes exactly 3 arguments (4 given)" and returns empty content.

Mirror urllib3-future's handling in the override: for 4-element options whose last element is a protocol string, apply "tcp" options truncated to the first 3 elements and skip "udp" options (all sockets created here are SOCK_STREAM). Plain 3-element options, and any other shapes stock urllib3 would accept, are passed through unchanged, so behavior with stock urllib3 (which only ever uses 3-element tuples) is identical.

Verified locally: with urllib3-future installed the loader previously raised the TypeError on every URL and now fetches successfully; with stock urllib3 2.3.0 and 2.7.0 fetches behave the same before and after.

Note: #26015 reported this same crash but attributed it to stock urllib3 2.x, which only uses 3-element tuples; the 4-element form comes from urllib3-future shadowing urllib3.

Fixes #26791
2026-07-23 23:33:55 -04:00
..
data refac: mv backend files to /open_webui dir 2024-09-04 16:54:48 +02:00
internal perf: cut per-request database session overhead (#27385) 2026-07-23 17:49:48 -05:00
migrations chore: format 2026-07-23 13:41:16 -04:00
models refac 2026-07-23 19:17:19 -04:00
retrieval fix: handle urllib3-future 4-element socket options in SSRF-safe web loader (#26796) 2026-07-23 23:33:55 -04:00
routers refac 2026-07-23 21:29:33 -04:00
socket refac 2026-07-23 22:20:50 -04:00
static refac 2026-07-20 22:27:13 -04:00
storage refac: modernize type annotations (PEP 604 / PEP 585) 2026-05-12 17:10:15 +09:00
tools fix: detect bare pipe alternation as regex in grep_knowledge_files (#26795) 2026-07-23 23:33:35 -04:00
utils refac 2026-07-23 23:16:28 -04:00
__init__.py refac 2026-06-17 03:01:11 +02:00
alembic.ini fix: Alembic CLI commands from failing 2025-08-15 04:17:47 -04:00
config.py refac 2026-07-23 22:44:04 -04:00
constants.py refac 2026-06-29 05:46:51 -05:00
env.py refac 2026-07-23 22:52:23 -04:00
events.py Log upstream provider rejections at warn/error level (#27238) 2026-07-23 03:42:48 -04:00
functions.py refac 2026-07-23 03:39:56 -04:00
main.py fix: capture uncompressed response bodies in audit logs (#27369) 2026-07-23 18:09:40 -05:00
tasks.py refac 2026-07-16 21:57:43 -04:00