From 01350705779294e9f4059c419fe9ee72b15ac736 Mon Sep 17 00:00:00 2001
From: "tyh.carl" <tyh.carl@gmail.com>
Date: Tue, 19 May 2026 17:02:55 +0800
Subject: [PATCH] fix(ui): validate window.location.href before use in
 UsagePageView open-tab link

Compute safeHref that only passes through http/https URLs to prevent
DOM-based XSS via tainted window.location data in the href sink (item #6).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../src/components/UsagePage/components/UsagePageView.tsx      | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx b/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx
index 41dfdb21d1b..3d74e32b8bc 100644
--- a/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx
+++ b/ui/litellm-dashboard/src/components/UsagePage/components/UsagePageView.tsx
@@ -59,6 +59,7 @@ interface UsagePageProps {
 
 const UsagePage: React.FC<UsagePageProps> = ({ teams, organizations }) => {
   const { accessToken, userRole, userId: userID, premiumUser } = useAuthorized();
+  const safeHref = /^https?:\/\//.test(window.location.href) ? window.location.href : "/";
   // Aggregated endpoint: try first, fall back to paginated if unavailable
   const [aggregatedData, setAggregatedData] = useState<{ results: DailyData[]; metadata: any } | null>(null);
   const [aggregatedFailed, setAggregatedFailed] = useState(false);
@@ -465,7 +466,7 @@ const UsagePage: React.FC<UsagePageProps> = ({ teams, organizations }) => {
                     Currently fetching spend data: fetched {paginatedResult.progress.currentPage} /{" "}
                     {paginatedResult.progress.totalPages} pages. Charts will update periodically as data loads. Moving
                     off of this page will stop and reset this. To continue using the UI in the meantime,{" "}
-                    <a href={window.location.href} target="_blank" rel="noopener noreferrer">
+                    <a href={safeHref} target="_blank" rel="noopener noreferrer">
                       open a new tab <ExportOutlined />
                     </a>
                     .