[PR #21887] [CLOSED] fix: handle non-numeric timestamp values in chat_message migration #113635

New Issue

GiteaMirror · 2026-05-18T14:03:38-05:00

GiteaMirror commented

2026-05-18 14:03:38 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/21887
Author: @npuigm
Created: 2/26/2026
Status: ❌ Closed

Base: dev ← Head: fix/migration-timestamp-type-coercion

📝 Commits (2)

96636f1 fix: handle non-numeric timestamp values in chat_message migration
e7e7a91 fix: use int(float()) to handle float-format timestamps

📊 Changes

1 file changed (+7 additions, -0 deletions)

View changed files

📝 backend/open_webui/migrations/versions/8452d01d26d7_add_chat_message_table.py (+7 -0)

📄 Description

Pull Request Checklist

Target branch: dev
Description: Provided below
Changelog: Included below
Documentation: No user-facing behavior change — migration internal fix only
Dependencies: No new dependencies
Testing: Manually tested against a database containing string timestamp values (from DAST security scanner injection). Migration completes successfully. Valid integer and float timestamps are unaffected.
Agentic AI Code: This PR was authored and tested by a human
Code review: Self-reviewed
Design & Architecture: Minimal 5-line fix, no new settings or architectural changes
Git Hygiene: Single atomic commit on a dedicated branch
Title Prefix: fix:

Changelog Entry

Description

The alembic migration 8452d01d26d7_add_chat_message_table (introduced in v0.8.5) crashes when the timestamp field inside chat message JSON data contains a non-numeric string value.

Root cause: The migration reads message.get("timestamp", now) and compares it with > and < against integers (lines 131–135). If timestamp is a string, Python raises:

TypeError: '>' not supported between instances of 'str' and 'int'

This rolls back the entire migration. On the next startup, the app finds an incomplete schema and returns 500 on /api/config, showing "Open WebUI Backend Required".

How string timestamps get into the database: In our case, an automated security scanner (DAST) injected path-traversal payloads into the chat API, which were stored verbatim in the timestamp field. Any corrupted or manually edited chat data with non-numeric timestamps would trigger the same crash.

Added

N/A

Changed

N/A

Deprecated

N/A

Removed

N/A

Fixed

Wrap timestamp in int() with a try/except (TypeError, ValueError) before the numeric comparisons in the 8452d01d26d7 migration
On failure, fall back to now — consistent with the existing fallback for out-of-range timestamps
5-line addition with zero impact on valid data paths

Security

N/A

Breaking Changes

N/A

Additional Information

Reproduction: any chat row with a non-numeric string in message.timestamp will crash the migration
Previously submitted as #21886, closed due to missing CLA text

Screenshots or Videos

N/A — this is a backend migration fix with no UI changes.

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/21887 **Author:** [@npuigm](https://github.com/npuigm) **Created:** 2/26/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/migration-timestamp-type-coercion` --- ### 📝 Commits (2) - [`96636f1`](https://github.com/open-webui/open-webui/commit/96636f1ecdc1567e0d1b0400d2effae415ce3c5c) fix: handle non-numeric timestamp values in chat_message migration - [`e7e7a91`](https://github.com/open-webui/open-webui/commit/e7e7a9135fc0e5fe7815778e0b5bd808801e9c77) fix: use int(float()) to handle float-format timestamps ### 📊 Changes **1 file changed** (+7 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/migrations/versions/8452d01d26d7_add_chat_message_table.py` (+7 -0) </details> ### 📄 Description # Pull Request Checklist - [x] **Target branch:** `dev` - [x] **Description:** Provided below - [x] **Changelog:** Included below - [ ] **Documentation:** No user-facing behavior change — migration internal fix only - [x] **Dependencies:** No new dependencies - [x] **Testing:** Manually tested against a database containing string timestamp values (from DAST security scanner injection). Migration completes successfully. Valid integer and float timestamps are unaffected. - [x] **Agentic AI Code:** This PR was authored and tested by a human - [x] **Code review:** Self-reviewed - [x] **Design & Architecture:** Minimal 5-line fix, no new settings or architectural changes - [x] **Git Hygiene:** Single atomic commit on a dedicated branch - [x] **Title Prefix:** `fix:` # Changelog Entry ### Description The alembic migration `8452d01d26d7_add_chat_message_table` (introduced in v0.8.5) crashes when the `timestamp` field inside chat message JSON data contains a non-numeric string value. **Root cause:** The migration reads `message.get("timestamp", now)` and compares it with `>` and `<` against integers (lines 131–135). If `timestamp` is a string, Python raises: ``` TypeError: '>' not supported between instances of 'str' and 'int' ``` This rolls back the entire migration. On the next startup, the app finds an incomplete schema and returns 500 on `/api/config`, showing "Open WebUI Backend Required". **How string timestamps get into the database:** In our case, an automated security scanner (DAST) injected path-traversal payloads into the chat API, which were stored verbatim in the `timestamp` field. Any corrupted or manually edited chat data with non-numeric timestamps would trigger the same crash. ### Added - N/A ### Changed - N/A ### Deprecated - N/A ### Removed - N/A ### Fixed - Wrap `timestamp` in `int()` with a `try/except (TypeError, ValueError)` before the numeric comparisons in the `8452d01d26d7` migration - On failure, fall back to `now` — consistent with the existing fallback for out-of-range timestamps - 5-line addition with zero impact on valid data paths ### Security - N/A ### Breaking Changes - N/A --- ### Additional Information - Reproduction: any chat row with a non-numeric string in `message.timestamp` will crash the migration - Previously submitted as #21886, closed due to missing CLA text ### Screenshots or Videos N/A — this is a backend migration fix with no UI changes. ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-05-18 14:03:38 -05:00

GiteaMirror closed this issue

2026-05-18 14:03:43 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#113635