github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-20 00:35:35 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

Escape voice-derived attributes in Azure TTS SSML (#25776)

Browse Source 
The Azure TTS handler (_tts_azure) interpolated the user-supplied voice,
and the locale derived from it, into the SSML xml:lang and <voice name>
attributes without XML-escaping, while the text body was already escaped
(2e75c6dbd). Escape both attributes too, so every user-derived value in
the SSML document is consistently encoded.

Co-authored-by: alanturing881 <alanturing881@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Classic298
2026-06-29 02:16:37 -05:00
committed by GitHub
co-authored by alanturing881 Claude Opus 4.8
parent ff25ccca65
commit 914039ac81
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/routers/audio.py
+2 -2
View File
@@ -442,8 +442,8 @@ async def _tts_azure(request, payload, file_path, file_body_path, user):
output_format = await Config.get('audio.tts.azure.speech_output_format')
ssml = (
f'<speak version="1.0" xmlns="http://www.w3.org/2001/10/synthesis" xml:lang="{locale}">'
f'<voice name="{language}">{html.escape(payload["input"])}</voice>'
f'<speak version="1.0" xmlns="http://www.w3.org/2001/10/synthesis" xml:lang="{html.escape(locale)}">'
f'<voice name="{html.escape(language)}">{html.escape(payload["input"])}</voice>'
f'</speak>'
)