Classic298andGitHub 5dcca59aee fix: route OAuth profile-picture fetch through the SSRF-safe session (#26699) ...

_process_picture_url validated the picture URL with validate_url() but then fetched it with a plain aiohttp session that resolves the hostname again at connect time, leaving a DNS-rebinding TOCTOU window (the same gap already closed for the RAG loader, the content probe, the image fetches and webhook delivery). Routing the fetch through get_ssrf_safe_session() pins the connect-time resolution via _SSRFSafeResolver and rejects non-global addresses, so a rebinding host can no longer redirect the fetch to loopback, RFC1918 or cloud-metadata endpoints. It also stops the forwarded OAuth access_token from leaking to a rebound internal target.

2026-07-27 00:56:24 -04:00

..

data

…

open_webui

fix: route OAuth profile-picture fetch through the SSRF-safe session (#26699)

2026-07-27 00:56:24 -04:00

.dockerignore

…

.gitignore

…

dev.sh

…

requirements-min.txt

…

requirements.txt

perf: stop resolving DNS on the thread pool (add aiodns) (#27440)

2026-07-26 23:29:52 -04:00

start_windows.bat

…

start.sh

…