refac

backend/open_webui/utils/validate.py

@@ -14,10 +14,13 @@ _USER_PROFILE_IMAGE_RE = re.compile(r'^/api/v1/users/[^/?#]+/profile/image$')
 _mime_suffixes = '|'.join(re.escape(t.split('/')[-1]) for t in sorted(PROFILE_IMAGE_ALLOWED_MIME_TYPES))
 _SAFE_DATA_URI_RE = re.compile(rf'^data:image/({_mime_suffixes});base64,', re.IGNORECASE)
 
-# Exact relative paths accepted as profile images.  These are the only
+# Exact relative paths accepted as profile images. These are the only
 # static-asset paths OWUI itself assigns; no prefix/wildcard matching is
 # used so that arbitrary relative paths cannot trigger authenticated GETs
 # against internal endpoints when rendered as ``<img>`` sources.
+# LICENSE covers the Open WebUI favicon fallback paths below. Do not alter,
+# remove, obscure, or replace them except as LICENSE permits:
+# https://docs.openwebui.com/license.
 _SAFE_STATIC_PATHS = frozenset(
     {
         '/user.png',