home-assistant / home-assistant/core
Webhooks being filtered due to unsafe byte query string
- Dominant language
- Python
- Stars
- 90.5k
- Forks
- 38.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 597
Description
### The problem
Some webhooks are being filtered. I use an ios automation to get my location an generate an email with the weather forecast for that day. It uses a webhook to pass the information to my HA server to generate the email. Since core version released around April of 2023 (sorry I don't know the exact version) they have been filtered by HA while other webhooks with different encoded text payloads do not. A same filtered request is below. The URL encoded text is:
Subject:
Clear 54°F / 80°F 0%
Body:
Today's forecast is Clear with a 0% chance of rain.
With a low of 54°F and a high of 80°F
### What version of Home Assistant Core has the issue?
2023.11.1
### What was the last working version of Home Assistant Core?
_No response_
### What type of installation are you running?
Home Assistant OS
### Integration causing the issue
Webhook Relay
### Link to integration documentation on our website
_No response_
### Diagnostics information
_No response_
### Example YAML snippet
_No response_
### Anything in the logs that might be useful for us?
```txt
WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a request with unsafe byte query string: /api/webhook/email=%20&subject=Clear%2054%C2%B0F%20/%2080%C2%B0F%200%25&body=Today's%20forecast%20is%20Clear%20with%20a%200%25%20chance%20of%20rain.%20%0A%0AWith%20a%20low%20of%2054%C2%B0F%20and%20a%20high%20of%2080%C2%B0F
```
### Additional information
_No response_
Contributor guide
Research direction
Start with the logged unsafe byte query string warning in the HTTP security filter and trace how the Webhook Relay request is handled. Reproduce the supplied URL-encoded request, then verify that valid webhook payloads with encoded temperature, percent, slash, and newline characters are accepted without weakening filtering of unsafe requests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100