From 741b64edb6c2ff04c4b787528cfca1c5b66a1a27 Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Thu, 25 Jun 2026 17:23:53 -0400 Subject: [PATCH] refac --- backend/open_webui/utils/webhook.py | 14 +++++--------- uv.lock | 1 - 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/backend/open_webui/utils/webhook.py b/backend/open_webui/utils/webhook.py index fb61a24d7b..5fc6440c07 100644 --- a/backend/open_webui/utils/webhook.py +++ b/backend/open_webui/utils/webhook.py @@ -1,15 +1,13 @@ import json import logging -import aiohttp from open_webui.config import WEBUI_FAVICON_URL from open_webui.env import ( AIOHTTP_CLIENT_ALLOW_REDIRECTS, AIOHTTP_CLIENT_SESSION_SSL, - AIOHTTP_CLIENT_TIMEOUT, VERSION, ) -from open_webui.retrieval.web.utils import validate_url +from open_webui.retrieval.web.utils import get_ssrf_safe_session, validate_url log = logging.getLogger(__name__) @@ -33,9 +31,9 @@ async def post_webhook( ) -> bool: try: log.debug(f'post_webhook: {url}, {message}, {event_data}') - # Block private-IP / loopback / cloud-metadata targets — the URL is - # caller-controlled (user notification settings under - # ENABLE_USER_WEBHOOKS, automation notification triggers). + # Block private-IP / loopback / cloud-metadata targets for every + # webhook source, including admin-managed event webhooks and + # user-configured notification URLs. validate_url(url) payload = {} @@ -80,9 +78,7 @@ async def post_webhook( payload = event_data log.debug(f'payload: {payload}') - async with aiohttp.ClientSession( - trust_env=True, timeout=aiohttp.ClientTimeout(total=AIOHTTP_CLIENT_TIMEOUT) - ) as session: + async with get_ssrf_safe_session() as session: async with session.post( url, json=payload, diff --git a/uv.lock b/uv.lock index a0286c5828..a1bd90b65d 100644 --- a/uv.lock +++ b/uv.lock @@ -2796,7 +2796,6 @@ wheels = [ [[package]] name = "open-webui" -version = "0.9.6" source = { editable = "." } dependencies = [ { name = "accelerate" },