Webhooks being filtered due to unsafe byte query string

[thorinman]

The problem

Some webhooks are being filtered. I use an ios automation to get my location an generate an email with the weather forecast for that day. It uses a webhook to pass the information to my HA server to generate the email. Since core version released around April of 2023 (sorry I don't know the exact version) they have been filtered by HA while other webhooks with different encoded text payloads do not. A same filtered request is below. The URL encoded text is:

Subject: Clear 54°F / 80°F 0%

Body: Today's forecast is Clear with a 0% chance of rain.

With a low of 54°F and a high of 80°F

What version of Home Assistant Core has the issue?

2023.11.1

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant OS

Integration causing the issue

Webhook Relay

Link to integration documentation on our website

No response

Diagnostics information

No response

Example YAML snippet

No response

Anything in the logs that might be useful for us?

WARNING (MainThread) [homeassistant.components.http.security_filter] Filtered a request with unsafe byte query string: /api/webhook/<removed>email=<removed>%20&subject=Clear%2054%C2%B0F%20/%2080%C2%B0F%200%25&body=Today's%20forecast%20is%20Clear%20with%20a%200%25%20chance%20of%20rain.%20%0A%0AWith%20a%20low%20of%2054%C2%B0F%20and%20a%20high%20of%2080%C2%B0F

Additional information

No response

[home-assistant[bot]]

webhooks documentation webhooks source

[home-assistant[bot]]

Hey there @home-assistant/core, mind taking a look at this issue as it has been labeled with an integration (http) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of `http` can trigger bot actions by commenting: - `@home-assistant close` Closes the issue. - `@home-assistant rename Awesome new title` Renames the issue. - `@home-assistant reopen` Reopen the issue. - `@home-assistant unassign http` Removes the current integration label and assignees on the issue, add the integration domain after the command.

_{^{(message by CodeOwnersMention)}}

---

http documentation http source _{^{(message by IssueLinks)}}

[PeterPalenik]

What I did as a workaround is that I base64 encoded the query parameter and then in the Webhook handling automation I decode it back. In your case {{subject | base64_encode}} and {{subject | base64_decode}}. Not sure why these base64 filters are not documented though.

[issue-triage-workflows[bot]]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

[thorinman]

Still an issue in 2024.3.0.

[issue-triage-workflows[bot]]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

[thorinman]

This is still an issue.

[issue-triage-workflows[bot]]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

[thorinman]

This is still an issue in 2924.9.1.