scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-11 22:51:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 124

fix(guardrails): satisfy type-discipline budget on the SSRF validation block

Browse source 
http_request re-bound the `headers` parameter when merging the restored
Host header (LIT011, budget +1 over the ceiling). Bind `request_headers`
instead and pass that to _execute_http_request.
This commit is contained in:
maycuatroi1 2026-08-15 06:56:55 +07:00
parent cc7646ea17
commit 059f1fcad4
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py
View file

@ -465,10 +465,11 @@ async def http_request(
# be reached by adding them to `user_url_allowed_hosts` in general_settings.
# `litellm.user_url_validation = False` disables this check entirely.
validated_url = url
request_headers = headers
if getattr(litellm, "user_url_validation", True):
try:
validated_url, host_header = validate_url(url)
headers = {**(headers or {}), "Host": host_header}
request_headers = {**(headers or {}), "Host": host_header}
except (SSRFError, ValueError) as e:
verbose_proxy_logger.warning("Custom code http_request SSRF blocked: %s", e)
return _http_error_response(f"Blocked: {e}")
@ -492,7 +493,7 @@ async def http_request(
)
try:
response: Final = await _execute_http_request(client, method, validated_url, headers, body, timeout)
response: Final = await _execute_http_request(client, method, validated_url, request_headers, body, timeout)
return _http_success_response(response)
except httpx.TimeoutException as e: