[GH-ISSUE #17800] issue: Pipeline HTML responses always end up in a too-short iframe because client strips scripts & resets height

GiteaMirror commented

2026-04-20 00:37:04 -05:00

Owner

Originally created by @ckemmler on GitHub (Sep 26, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/17800

Check Existing Issues

I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I am using the latest version of Open WebUI.

Installation Method

Git Clone

Open WebUI Version

0.6.31

Ollama Version (if applicable)

No response

Operating System

macOS Tahoe

Browser (if applicable)

Brave

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

Either: the iframe respects the min-height / fixed size specified in the
returned HTML; or
There’s a supported API/valve to specify the mounted iframe height when a
pipeline/tool emits HTML.

Actual Behavior

The iframe sizing script sets this.style.height = (this.contentWindow.document.body.scrollHeight + 20) + "px" immediately after
load.
Because inline scripts/attributes are stripped by DOMPurify, pipelines
cannot override that behavior.
Result: iframe collapses to whatever the content happens to be (usually
~240px) despite setting min-height: 750px inside the HTML.

Steps to Reproduce

Create a simple pipeline that responds with JSON { "type": "html", "content": "<!DOCTYPE html>…<body style='min-height:750px'>…</body>" }.
Import the pipeline (function) into Open WebUI and enable it in a chat.
Trigger the function so the HTML response renders inline.
Inspect the iframe via DevTools.

Logs & Screenshots

Document shows html, body { min-height: 750px; } but scrollHeight still
comes back around 240px, so the iframe height keeps resetting.

Additional Information

I’m embedding a pipeline that returns HTML cards (Calibre library results).
The backend wraps the cards in a standalone HTML document (with min-height: 750px) and responds through Open WebUI’s pipeline interface.

On the client, the rendered iframe always shrinks to the actual card height
(~240px).
Adding inline <script> or attributes to force the height is ineffective
because DOMPurify strips them; the chat frontend then runs its own
onload="this.style.height=...scrollHeight...", which recalculates the
shrinked size.

Originally created by @ckemmler on GitHub (Sep 26, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/17800 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Git Clone ### Open WebUI Version 0.6.31 ### Ollama Version (if applicable) _No response_ ### Operating System macOS Tahoe ### Browser (if applicable) Brave ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior - Either: the iframe respects the `min-height` / fixed size specified in the returned HTML; or - There’s a supported API/valve to specify the mounted iframe height when a pipeline/tool emits HTML. ### Actual Behavior - The iframe sizing script sets `this.style.height = (this.contentWindow.document.body.scrollHeight + 20) + "px"` immediately after load. - Because inline scripts/attributes are stripped by DOMPurify, pipelines cannot override that behavior. - Result: iframe collapses to whatever the content happens to be (usually ~240px) despite setting `min-height: 750px` inside the HTML. ### Steps to Reproduce 1. Create a simple pipeline that responds with JSON `{ "type": "html", "content": "<!DOCTYPE html>…<body style='min-height:750px'>…</body>" }`. 2. Import the pipeline (function) into Open WebUI and enable it in a chat. 3. Trigger the function so the HTML response renders inline. 4. Inspect the iframe via DevTools. ### Logs & Screenshots - Document shows `html, body { min-height: 750px; }` but `scrollHeight` still comes back around 240px, so the iframe height keeps resetting. ### Additional Information I’m embedding a pipeline that returns HTML cards (Calibre library results). The backend wraps the cards in a standalone HTML document (with `min-height: 750px`) and responds through Open WebUI’s pipeline interface. On the client, the rendered iframe always shrinks to the actual card height (~240px). Adding inline `<script>` or attributes to force the height is ineffective because DOMPurify strips them; the chat frontend then runs its own `onload="this.style.height=...scrollHeight..."`, which recalculates the shrinked size.