mirror of
https://github.com/open-webui/open-webui.git
synced 2026-09-17 23:52:29 +00:00
38a8dc9f32
Any signed-in user can grow Open WebUI's memory without bound by posting model entries with invalid profile image URLs. ModelMeta's validator keeps a set of every distinct rejected value so it warns about each one once, storing the full string with no size cap. FastAPI validates the request body before create_new_model reaches its workspace.models permission check, so the value is retained even when the caller is refused with a 401. The set and the warning it served both go away; the validator clears the value exactly as before. The warning named no model and truncated the value at 80 characters, so it identified nothing. models/users.py swallows the identical ValueError and substitutes a fallback with no logging, so silence matches the neighbouring code. Measured over the real create route with distinct 4KB invalid values: 8.9 MB retained at 2,000 values and 33.7 MB at 8,000 before, flat at 1.1 MB after. |
||
|---|---|---|
| .. | ||
| access_grants.py | ||
| auths.py | ||
| automations.py | ||
| calendar.py | ||
| channels.py | ||
| chat_messages.py | ||
| chats.py | ||
| config.py | ||
| feedbacks.py | ||
| files.py | ||
| folders.py | ||
| functions.py | ||
| groups.py | ||
| knowledge.py | ||
| memories.py | ||
| messages.py | ||
| models.py | ||
| notes.py | ||
| oauth_sessions.py | ||
| prompt_history.py | ||
| prompts.py | ||
| shared_chats.py | ||
| skills.py | ||
| tags.py | ||
| tools.py | ||
| users.py | ||