scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-27 01:22:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(ui): validate window.location.href before use in UsagePageView open-tab link

Browse source 
Compute safeHref that only passes through http/https URLs to prevent
DOM-based XSS via tainted window.location data in the href sink (item #6).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
tyh.carl 2026-05-19 17:02:55 +08:00
parent 64beb47c04
commit 0135070577
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx
View file

@ -59,6 +59,7 @@ interface UsagePageProps {
const UsagePage: React.FC<UsagePageProps> = ({ teams, organizations }) => {
const { accessToken, userRole, userId: userID, premiumUser } = useAuthorized();
const safeHref = /^https?:\/\//.test(window.location.href) ? window.location.href : "/";
// Aggregated endpoint: try first, fall back to paginated if unavailable
const [aggregatedData, setAggregatedData] = useState<{ results: DailyData[]; metadata: any } | null>(null);
const [aggregatedFailed, setAggregatedFailed] = useState(false);
@ -465,7 +466,7 @@ const UsagePage: React.FC<UsagePageProps> = ({ teams, organizations }) => {
Currently fetching spend data: fetched {paginatedResult.progress.currentPage} /{" "}
{paginatedResult.progress.totalPages} pages. Charts will update periodically as data loads. Moving
off of this page will stop and reset this. To continue using the UI in the meantime,{" "}
<a href={window.location.href} target="_blank" rel="noopener noreferrer">
<a href={safeHref} target="_blank" rel="noopener noreferrer">
open a new tab <ExportOutlined />
</a>
.