ewilliams28/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-08-26 23:44:48 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix: bound extracted document metadata by the upload size limit by default (#29025)

Browse Source 
"RAG_METADATA_MAX_VALUE_CHARS" ships unset, and unset means no bound at all, so the limit only protects the deployments that already knew to configure it. A small Office document is a zip archive, and one crafted to expand enormously during extraction can turn a few hundred kilobytes into gigabytes of metadata held in memory; uploading it a handful of times is enough to exhaust a server and take Open WebUI down with it.

When no explicit limit is configured, the bound now follows "RAG_FILE_MAX_SIZE" instead of being absent, on the reasoning that a document cannot legitimately carry more metadata than the file itself is allowed to be. That keeps the number from being an arbitrary guess: it is whatever the administrator already decided an upload may weigh. Setting "RAG_METADATA_MAX_VALUE_CHARS" explicitly still wins, and a deployment that leaves both unset is unchanged, which is the same posture the upload limit itself takes.

"RAG_FILE_MAX_SIZE" is in MB and is treated as unset when it is zero, matching how the document loader already reads it.
This commit is contained in:
Classic298
2026-08-25 21:50:27 +02:00
committed by GitHub
parent 6dcc2d5269
commit 45f4a87e85
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/open_webui/env.py
+6 -1
View File
@@ -823,8 +823,13 @@ BYPASS_RETRIEVAL_ACCESS_CONTROL = os.getenv('BYPASS_RETRIEVAL_ACCESS_CONTROL', '
# denied — closing the legacy unscoped namespace.
ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS = os.getenv('ENABLE_RETRIEVAL_UNSCOPED_COLLECTIONS', 'False').lower() == 'true'
# Falls back to the upload size limit, because a document cannot legitimately carry more metadata
# than the file itself is allowed to be. Left unbounded, a small archive that expands enormously
# during extraction can exhaust memory. RAG_FILE_MAX_SIZE is in MB.
RAG_METADATA_MAX_VALUE_CHARS = (
int(os.getenv('RAG_METADATA_MAX_VALUE_CHARS')) if os.getenv('RAG_METADATA_MAX_VALUE_CHARS') else None
int(os.getenv('RAG_METADATA_MAX_VALUE_CHARS'))
if os.getenv('RAG_METADATA_MAX_VALUE_CHARS')
else ((int(os.getenv('RAG_FILE_MAX_SIZE', '0')) or 0) * 1024 * 1024 or None)
)
MINERU_MAX_MARKDOWN_BYTES = (