0dc29a2 fix: Fix path leakage caused by file upload
📊 Changes
1 file changed (+1 additions, -1 deletions)
View changed files
📝backend/open_webui/routers/files.py (+1 -1)
📄 Description
Pull Request Checklist
Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.
Before submitting, make sure you've checked the following:
Target branch: Please verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request.
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Documentation: Have you updated relevant documentation Open WebUI Docs, or other documentation sources?
Dependencies: Are there any new dependencies? Have you updated the dependency versions in the documentation?
Testing: Have you written and run sufficient tests to validate the changes?
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
Prefix: To clearly categorize this pull request, prefix the pull request title using one of the following:
BREAKING CHANGE: Significant changes that may affect compatibility
build: Changes that affect the build system or external dependencies
ci: Changes to our continuous integration processes or workflows
chore: Refactor, cleanup, or other non-functional code changes
docs: Documentation update or addition
feat: Introduces a new feature or enhancement to the codebase
fix: Bug fix or error correction
i18n: Internationalization or localization changes
perf: Performance improvement
refactor: Code restructuring for better maintainability, readability, or scalability
style: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.)
test: Adding missing tests or correcting existing tests
WIP: Work in progress, a temporary label for incomplete or ongoing work
The exception will then contain the absolute path to the file to be saved:
{
"detail": "[ERROR: [Errno 36] File name too long: '/app/backend/data/uploads/{uuid}-{a*50000}.txt`]"
}
Added
[List any new features, functionalities, or additions]
Changed
[List any changes, updates, refactorings, or optimizations]
Deprecated
[List any deprecated functionality or features that have been removed]
Removed
[List any removed features, files, or functionalities]
Fixed
[List any fixes, corrections, or bug fixes]
Security
backend/open_webui/routers/files.py: Instead of outputting the python error message directly, we should filter it and then output it.
Breaking Changes
BREAKING CHANGE: [List any breaking changes affecting compatibility or functionality]
Additional Information
[Insert any additional context, notes, or explanations for the changes]
[Reference any related issues, commits, or other relevant information]
Screenshots or Videos
[Attach any relevant screenshots or videos demonstrating the changes]
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/14328
**Author:** [@ShirasawaSama](https://github.com/ShirasawaSama)
**Created:** 5/26/2025
**Status:** ✅ Merged
**Merged:** 5/26/2025
**Merged by:** [@tjbck](https://github.com/tjbck)
**Base:** `main` ← **Head:** `fix_path_leakage_caused_by_file_upload`
---
### 📝 Commits (1)
- [`0dc29a2`](https://github.com/open-webui/open-webui/commit/0dc29a220f66f83cb7d64f7b99429e0fb520e51e) fix: Fix path leakage caused by file upload
### 📊 Changes
**1 file changed** (+1 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/routers/files.py` (+1 -1)
</details>
### 📄 Description
# Pull Request Checklist
### Note to first-time contributors: Please open a discussion post in [Discussions](https://github.com/open-webui/open-webui/discussions) and describe your changes before submitting a pull request.
**Before submitting, make sure you've checked the following:**
- [x] **Target branch:** Please verify that the pull request targets the `dev` branch.
- [x] **Description:** Provide a concise description of the changes made in this pull request.
- [ ] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description.
- [ ] **Documentation:** Have you updated relevant documentation [Open WebUI Docs](https://github.com/open-webui/docs), or other documentation sources?
- [ ] **Dependencies:** Are there any new dependencies? Have you updated the dependency versions in the documentation?
- [x] **Testing:** Have you written and run sufficient tests to validate the changes?
- [x] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
- [x] **Prefix:** To clearly categorize this pull request, prefix the pull request title using one of the following:
- **BREAKING CHANGE**: Significant changes that may affect compatibility
- **build**: Changes that affect the build system or external dependencies
- **ci**: Changes to our continuous integration processes or workflows
- **chore**: Refactor, cleanup, or other non-functional code changes
- **docs**: Documentation update or addition
- **feat**: Introduces a new feature or enhancement to the codebase
- **fix**: Bug fix or error correction
- **i18n**: Internationalization or localization changes
- **perf**: Performance improvement
- **refactor**: Code restructuring for better maintainability, readability, or scalability
- **style**: Changes that do not affect the meaning of the code (white space, formatting, missing semi-colons, etc.)
- **test**: Adding missing tests or correcting existing tests
- **WIP**: Work in progress, a temporary label for incomplete or ongoing work
# Changelog Entry
### Description
We can construct a very long filename such as `(a*50000).txt` to trigger the exception catching branch https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/files.py#L192 .
The exception will then contain the absolute path to the file to be saved:
```
{
"detail": "[ERROR: [Errno 36] File name too long: '/app/backend/data/uploads/{uuid}-{a*50000}.txt`]"
}
```
### Added
- [List any new features, functionalities, or additions]
### Changed
- [List any changes, updates, refactorings, or optimizations]
### Deprecated
- [List any deprecated functionality or features that have been removed]
### Removed
- [List any removed features, files, or functionalities]
### Fixed
- [List any fixes, corrections, or bug fixes]
### Security
- `backend/open_webui/routers/files.py`: Instead of outputting the python error message directly, we should filter it and then output it.
### Breaking Changes
- **BREAKING CHANGE**: [List any breaking changes affecting compatibility or functionality]
---
### Additional Information
- [Insert any additional context, notes, or explanations for the changes]
- [Reference any related issues, commits, or other relevant information]
### Screenshots or Videos
- [Attach any relevant screenshots or videos demonstrating the changes]
### Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/14328
Author: @ShirasawaSama
Created: 5/26/2025
Status: ✅ Merged
Merged: 5/26/2025
Merged by: @tjbck
Base:
main← Head:fix_path_leakage_caused_by_file_upload📝 Commits (1)
0dc29a2fix: Fix path leakage caused by file upload📊 Changes
1 file changed (+1 additions, -1 deletions)
View changed files
📝
backend/open_webui/routers/files.py(+1 -1)📄 Description
Pull Request Checklist
Note to first-time contributors: Please open a discussion post in Discussions and describe your changes before submitting a pull request.
Before submitting, make sure you've checked the following:
devbranch.Changelog Entry
Description
We can construct a very long filename such as
(a*50000).txtto trigger the exception catching branch https://github.com/open-webui/open-webui/blob/main/backend/open_webui/routers/files.py#L192 .The exception will then contain the absolute path to the file to be saved:
Added
Changed
Deprecated
Removed
Fixed
Security
backend/open_webui/routers/files.py: Instead of outputting the python error message directly, we should filter it and then output it.Breaking Changes
Additional Information
Screenshots or Videos
Contributor License Agreement
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.