mirror of
https://github.com/open-webui/open-webui.git
synced 2026-05-07 03:18:23 -05:00
[GH-ISSUE #7773] Feature: Support .ZIP for "uploads" #14883
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#14883
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @spammenotinoz on GitHub (Dec 11, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/7773
Feature Request
Ability to upload .zip files into the chat.
Current Behavior requires extraction of zip file contents before they can be uploaded.
When attempted the error received is
File "/usr/local/lib/python3.11/site-packages/langchain_community/document_loaders/text.py", line 46, in lazy_load
detected_encodings = detect_file_encodings(self.file_path)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/langchain_community/document_loaders/helpers.py", line 50, in detect_file_encodings
raise RuntimeError(f"Could not detect encoding for {file_path}")
RuntimeError: Could not detect encoding for /app/backend/data/uploads/hshfsdfshdfdslfk_pure-support-guide.zip
ERROR [open_webui.apps.webui.routers.files] 400: Could not detect encoding for /app/backend/data/uploads/hshfsdfshdfdslf_pure-support-guide.zip
@spammenotinoz commented on GitHub (Dec 16, 2024):
Hi silentoplayz, is this closed as NOT intended or closed due to it's already supported but a user error, as in I am doing something wrong.
@spammenotinoz commented on GitHub (Dec 16, 2024):
Thank-you for taking the time to provide such a comprehensive response.
@bnewddt commented on GitHub (Dec 29, 2024):
@slientoplayz
understood, but somehow we have to get rid of openai services
@ldemailly commented on GitHub (Mar 6, 2025):
For the record this seems a bit strange... The whole idea is running locally... if I upload bad zip files, it's sort of my fault and I don't see how that's worse than fetching random URLs from the internet? it would be a lot more convenient than adding files one by one when for instance wanting to give a source tree as context
@Dibidydabs commented on GitHub (Mar 18, 2025):
This refusal makes no sense.
Just as Idemailly states, it is far more dangerous to scrape webpages.
You have exploitDB and other places that have active malware, droppers and other malicious code.
Github contains malicious code as well.
Also, if it was such a problem, why does almost every service out there accept them?
Not trying to ruffle feathers, but just pointing out that the excuse for not letting us be able to upload zips seems very arbitrary.
As for zip slip, that is an easy fix.
Every zip is in its only subfolder. No overwriting the files this way.
Also implementing a simple script to rename files of duplicates usually works quite well.
As for arbitrary code execution. That shouldn't happen unless their is specific code to try and install from a zip file. Or to execute scripts from a zip file. Just simply extracting and moving it to a folder should not allow arbitrary code.
For resource exhaustion. You can simply put a toggle to enable or disable the allowance of zip files for those that are in a production environment. You can also set a file size limit on the zip files. Then you could also set it to process in chunks/shards to reduce the resources needed.
Again, for malware content, that is an excuse.
As you should not be executing any code from an uploaded zip file.
This should be standard anyways.
If I upload a .sh file, does it execute the file or does it read the file?
If I upload a python file, does it just read the code or does it execute the code?
Is this not an option you can just turn on or off? I have a toggle to disable code execution.
It shouldn't be too hard to disable arbitrary code execution from an uploaded file.
@GameBully2K commented on GitHub (Apr 18, 2025):
Maybe make it a feature that only runs on localhost with CORS policy since this would be beneficial for local developement
@ifgreulich commented on GitHub (Jun 26, 2025):
I agree with @Dibidydabs, it's more a matter of careful implementation of zip file handling and can be implemented safely. Office file formats (e.g. docx or PDF, which is supported) are much more problematic. Even PDF can contain JavaScript...
Actually, not being able to upload archive files (at least zip) reduces the usability of a in my eyes well done UI considerably:
Maybe you (the team may rethink the denial of the feature request?
@Krashnicov commented on GitHub (Jul 9, 2025):
I feel there is a lot of this convo that I can't see, not sure why?
Either way, a reconsideration of this (I infer that it's closed due to not intended?) would be good and useful.
@BestBackwards commented on GitHub (Jul 30, 2025):
Per the above, I have raised another feature request for this as I believe this request was improperly handled by one of the contributors.
@silentoplayz commented on GitHub (Jul 30, 2025):
This issue was handled with security of our users in mind. I could've very easily closed it as "not planned". Anyways, I'll try to remain respectful of other people's perspectives and will let the actual maintainer handle the new issue post as he wishes. I'm no longer taking part of this discussion.