home-assistant / home-assistant/core

Webhooks being filtered due to unsafe byte query string

Open
#103,458 23 comments 0 reactions 0 assignees View on GitHub
core integration: http integration: webhook
Dominant language
Python
Stars
90.5k
Forks
38.6k
Avg merge
1d 2h
Merged PRs (30d)
597

Description

### The problem

Some webhooks are being filtered. I use an ios automation to get my location an generate an email with the weather forecast for that day. It uses a webhook to pass the information to my HA server to generate the email. Since core version released around April of 2023 (sorry I don't know the exact version) they have been filtered by HA while other webhooks with different encoded text payloads do not. A same filtered request is below. The URL encoded text is:

Subject:
Clear 54°F / 80°F 0%

Body:
Today's forecast is Clear with a 0% chance of rain.

With a low of 54°F and a high of 80°F

### What version of Home Assistant Core has the issue?

2023.11.1

### What was the last working version of Home Assistant Core?

_No response_

### What type of installation are you running?

Home Assistant OS

### Integration causing the issue

Webhook Relay

### Link to integration documentation on our website

_No response_

### Diagnostics information

_No response_

### Example YAML snippet

_No response_

### Anything in the logs that might be useful for us?

```txt
WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a request with unsafe byte query string: /api/webhook/email=%20&subject=Clear%2054%C2%B0F%20/%2080%C2%B0F%200%25&body=Today's%20forecast%20is%20Clear%20with%20a%200%25%20chance%20of%20rain.%20%0A%0AWith%20a%20low%20of%2054%C2%B0F%20and%20a%20high%20of%2080%C2%B0F
```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the logged unsafe byte query string warning in the HTTP security filter and trace how the Webhook Relay request is handled. Reproduce the supplied URL-encoded request, then verify that valid webhook payloads with encoded temperature, percent, slash, and newline characters are accepted without weakening filtering of unsafe requests.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.