fix: add SSRF protection to OAuth profile picture URL fetching (#23356)

backend/open_webui/utils/oauth.py

@@ -81,6 +81,7 @@ from open_webui.utils.misc import parse_duration
 from open_webui.utils.auth import get_password_hash, create_token
 from open_webui.utils.webhook import post_webhook
 from open_webui.utils.groups import apply_default_group_assignment
+from open_webui.retrieval.web.utils import validate_url
 
 from mcp.shared.auth import (
     OAuthClientMetadata as MCPOAuthClientMetadata,
@@ -1330,6 +1331,8 @@ class OAuthManager:
             return '/user.png'
 
         try:
+            validate_url(picture_url)
+
             get_kwargs = {}
             if access_token:
                 get_kwargs['headers'] = {