Merge 24d1a8cb8a into 85dc7cb62e

litellm/proxy/management_endpoints/key_management_endpoints.py

@@ -7766,7 +7766,10 @@ def _validate_key_alias_format(key_alias: str | None) -> None:
         raise_if_unsafe_secret_name(key_alias)
     except ValueError:
         raise ProxyException(
-            message="Invalid key_alias",
+            message=(
+                "Invalid key_alias: must not contain control characters (such as tab or newline) "
+                + 'or a ".." path segment'
+            ),
             type=ProxyErrorTypes.bad_request_error,
             param="key_alias",
             code=400,

tests/test_litellm/proxy/management_endpoints/test_key_management_endpoints.py

@@ -10630,6 +10630,7 @@ class TestValidateKeyAliasFormat:
             "foo\n- !grant\n  role: !!admin\n  member: attacker",
             "foo\rbar",
             "foo\x00bar",
+            "my-test-key\t",
         ],
     )
     def test_validate_key_alias_format_rejects_traversal_and_control_chars_even_when_flag_disabled(
@@ -10648,6 +10649,8 @@ class TestValidateKeyAliasFormat:
             _validate_key_alias_format(unsafe_alias)
         assert str(exc.value.code) == "400"
         assert "Invalid key_alias" in str(exc.value.message)
+        assert "control characters" in str(exc.value.message)
+        assert '".." path segment' in str(exc.value.message)
 
     def test_validate_key_alias_format_valid(self, monkeypatch):
         from litellm.proxy.management_endpoints.key_management_endpoints import (