From 22d34960e5471e7640a4b99e72387401dcf85218 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 2 Sep 2026 09:56:17 -0700 Subject: [PATCH] fix(vector_stores): redact wire-protocol connection strings in management responses A MongoDB vector store's whole credential is its connection string, and mongodb+srv://:@ embeds the database password. None of the masker's default patterns (api_key, secret, token, credential) match a key named mongodb_connection_string, so /vector_store/list and /vector_store/info returned it verbatim to every caller that can read a vector store. SensitiveDataMasker gains extra_sensitive_patterns, which unions onto the defaults instead of replacing them, and the vector-store redactor adds "connection" so the URI is masked while mongodb_database, mongodb_collection and the field names stay readable. --- .../sensitive_data_masker.py | 42 +++++++++++-------- .../management_endpoints.py | 5 ++- .../test_sensitive_data_masker.py | 19 +++++++++ .../test_vector_store_endpoints.py | 36 ++++++++++++++++ 4 files changed, 84 insertions(+), 18 deletions(-) diff --git a/litellm/litellm_core_utils/sensitive_data_masker.py b/litellm/litellm_core_utils/sensitive_data_masker.py index 3d60c1bda12..3b0806ab069 100644 --- a/litellm/litellm_core_utils/sensitive_data_masker.py +++ b/litellm/litellm_core_utils/sensitive_data_masker.py @@ -6,33 +6,41 @@ from pydantic import BaseModel from litellm.constants import DEFAULT_MAX_RECURSE_DEPTH_SENSITIVE_DATA_MASKER +_DEFAULT_SENSITIVE_PATTERNS: Final = frozenset( + { + "password", + "secret", + "key", + "token", + "auth", + "authorization", + "credential", + # Plural form: Vertex uses ``vertex_credentials``; segment-exact + # matching otherwise misses it because "credential" != "credentials". + "credentials", + "access", + "private", + "certificate", + "fingerprint", + "tenancy", + } +) + + class SensitiveDataMasker: def __init__( self, sensitive_patterns: set[str] | None = None, + extra_sensitive_patterns: set[str] | None = None, non_sensitive_overrides: set[str] | None = None, visible_prefix: int = 4, visible_suffix: int = 4, mask_char: str = "*", mask_short_values: bool = True, ): - self.sensitive_patterns = sensitive_patterns or { - "password", - "secret", - "key", - "token", - "auth", - "authorization", - "credential", - # Plural form: Vertex uses ``vertex_credentials``; segment-exact - # matching otherwise misses it because "credential" != "credentials". - "credentials", - "access", - "private", - "certificate", - "fingerprint", - "tenancy", - } + self.sensitive_patterns = (sensitive_patterns or _DEFAULT_SENSITIVE_PATTERNS) | ( + extra_sensitive_patterns or frozenset() + ) # If any key segment matches one of these, the key is not considered sensitive # even if it also matches a sensitive pattern. For example, "input_cost_per_token" # contains "token" but "cost" overrides that — it's a pricing field, not a secret. diff --git a/litellm/proxy/vector_store_endpoints/management_endpoints.py b/litellm/proxy/vector_store_endpoints/management_endpoints.py index 183a03cc13c..a62c0f711cb 100644 --- a/litellm/proxy/vector_store_endpoints/management_endpoints.py +++ b/litellm/proxy/vector_store_endpoints/management_endpoints.py @@ -59,7 +59,10 @@ def _row_to_vector_store(row: "_VectorStoreRow") -> LiteLLM_ManagedVectorStore: return LiteLLM_ManagedVectorStore(**row.model_dump()) -_LITELLM_PARAMS_MASKER: Final = SensitiveDataMasker() +# "connection" covers wire-protocol providers whose whole credential is a URI +# (mongodb_connection_string embeds the username and password), which the +# default api_key/secret/token patterns do not match. +_LITELLM_PARAMS_MASKER: Final = SensitiveDataMasker(extra_sensitive_patterns={"connection"}) _REDACT_LITELLM_PARAMS_MAX_DEPTH: Final = 10 diff --git a/tests/test_litellm/litellm_core_utils/test_sensitive_data_masker.py b/tests/test_litellm/litellm_core_utils/test_sensitive_data_masker.py index f6b8a93c472..27a83223864 100644 --- a/tests/test_litellm/litellm_core_utils/test_sensitive_data_masker.py +++ b/tests/test_litellm/litellm_core_utils/test_sensitive_data_masker.py @@ -312,3 +312,22 @@ def test_mask_credentials_in_payload_masks_only_sensitive_string_leaves(): assert masked != plaintext assert masked.startswith(plaintext[:4]) assert masked.endswith(plaintext[-4:]) + + +def test_extra_sensitive_patterns_add_to_the_defaults(): + from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker + + masker = SensitiveDataMasker(extra_sensitive_patterns={"connection"}) + + assert masker.is_sensitive_key("mongodb_connection_string") is True + assert masker.is_sensitive_key("api_key") is True + assert masker.is_sensitive_key("aws_secret_access_key") is True + assert masker.is_sensitive_key("mongodb_database") is False + + +def test_extra_sensitive_patterns_do_not_leak_into_other_maskers(): + from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker + + SensitiveDataMasker(extra_sensitive_patterns={"connection"}) + + assert SensitiveDataMasker().is_sensitive_key("mongodb_connection_string") is False diff --git a/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py b/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py index eae6f90863a..16ec6e9796c 100644 --- a/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py +++ b/tests/test_litellm/proxy/vector_store_endpoints/test_vector_store_endpoints.py @@ -1,3 +1,4 @@ +import json from datetime import datetime, timezone from unittest.mock import AsyncMock, MagicMock, patch @@ -2700,6 +2701,41 @@ class TestRedactSensitiveLitellmParams: for k, v in params.items(): assert out[k] == v, f"{k} should be preserved verbatim" + def test_redacts_wire_protocol_connection_strings(self): + """ + A MongoDB vector store's whole credential is its connection string: + ``mongodb+srv://:@`` embeds the database + password, and none of the default api_key/secret/token patterns match + the key name, so an unextended masker returns it verbatim to every + caller of /vector_store/list and /vector_store/info. + """ + from litellm.constants import REDACTED_BY_LITELM_STRING + from litellm.proxy.vector_store_endpoints.management_endpoints import ( + _redact_sensitive_litellm_params, + ) + + password = "hunter2-not-for-callers" + params = { + "mongodb_connection_string": f"mongodb+srv://dbuser:{password}@cluster0.mongodb.net", + "mongodb_database": "sample_mflix", + "mongodb_collection": "embedded_movies", + "mongodb_embedding_field": "plot_embedding", + "mongodb_text_field": "plot", + "litellm_embedding_model": "openai/text-embedding-ada-002", + } + out = _redact_sensitive_litellm_params(params) + + assert out["mongodb_connection_string"] == REDACTED_BY_LITELM_STRING + assert password not in json.dumps(out) + for k in ( + "mongodb_database", + "mongodb_collection", + "mongodb_embedding_field", + "mongodb_text_field", + "litellm_embedding_model", + ): + assert out[k] == params[k], f"{k} is not a credential and must survive redaction" + def test_handles_none_and_empty(self): from litellm.proxy.vector_store_endpoints.management_endpoints import ( _redact_sensitive_litellm_params,