scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-06 02:48:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 103

address greptile review feedback (greploop iteration 4)

Browse source 
- asqav: apply recursive sensitive-key redaction to metadata before writing audit record

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Sameer Kankute 2026-06-29 11:48:20 +05:30
parent 93b79a3259
commit 31f3736d27
No known key found for this signature in database
1 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
litellm/integrations/asqav/asqav.py
View file

@ -72,6 +72,15 @@ def _content_digest(value: object) -> str | None:
_SENSITIVE_KEYS = frozenset({"user_api_key", "Authorization", "authorization", "token", "api_key"})
def _redact_sensitive(obj: Any, depth: int = 0) -> Any:
"""Recursively drop sensitive keys from dicts; cap depth to avoid unbounded traversal."""
if depth > 5 or not isinstance(obj, dict):
return obj
return {k: _redact_sensitive(v, depth + 1) for k, v in obj.items() if k not in _SENSITIVE_KEYS}
_PROXY_IDENTITY_KEYS = frozenset(
{
"user_api_key_user_id",
@ -142,8 +151,8 @@ def _extract_loggable(
model: str = kwargs.get("model", "")
messages: Any = kwargs.get("messages")
raw_metadata: Any = dict(kwargs.get("metadata") or kwargs.get("litellm_metadata") or {})
# Drop sensitive keys from top-level metadata before writing to the audit log
metadata: dict[str, Any] = {k: v for k, v in raw_metadata.items() if k not in _SENSITIVE_KEYS}
# Recursively drop sensitive keys before writing to the audit log
metadata: dict[str, Any] = _redact_sensitive(raw_metadata)
_merge_proxy_metadata(kwargs, metadata)
latency_ms: int | None = None
@ -175,7 +184,7 @@ def _extract_loggable(
"provider_request_id": provider_request_id,
"messages_digest": messages_digest,
"response_content_digest": response_content_digest,
"metadata": {k: v for k, v in (metadata or {}).items() if isinstance(k, str)},
"metadata": _redact_sensitive({k: v for k, v in (metadata or {}).items() if isinstance(k, str)}),
}