scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-15 23:31:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 165

fix: extend request body parameter restrictions to cloud provider auth fields

Browse source
This commit is contained in:
Yuneng Jiang 2026-04-22 12:38:25 -07:00
parent 09cd7e383e
commit 051d49f2fb
No known key found for this signature in database
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
litellm/proxy/auth/auth_utils.py
View file

@ -151,7 +151,15 @@ def is_request_body_safe(
A malicious user can set the api_base to their own domain and invoke POST /chat/completions to intercept and steal the OpenAI API key.
Relevant issue: https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997
"""
banned_params = ["api_base", "base_url", "user_config"]
banned_params = [
"api_base",
"base_url",
"user_config",
"aws_sts_endpoint",
"aws_web_identity_token",
"aws_role_name",
"vertex_credentials",
]
for param in banned_params:
if (