scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-11 03:38:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 82

fix(tags): strip CR/LF from tag name before logging Redis failure

Browse source 
CodeQL flagged this as a log-injection vector: the raw, admin-supplied
tag name was interpolated into a warning log line. /key/update's
equivalent path logs a hashed key, not raw user input, so this pattern
did not exist there.
This commit is contained in:
Arnold Galovics 2026-09-18 09:23:08 +02:00
parent b902bf210e
commit 38eace0342
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
litellm/proxy/management_endpoints/tag_management_endpoints.py
View file

@ -485,10 +485,13 @@ async def update_tag(
try:
await spend_counter_cache.redis_cache.async_set_cache(key=counter_key, value=tag.spend, ttl=60)
except Exception as redis_err: # noqa: BLE001 # best-effort refresh: a Redis failure must not fail the request
# tag.name is admin-supplied; strip CR/LF before it reaches the logs so it
# cannot forge additional log lines.
safe_counter_key: Final = counter_key.replace("\r", "").replace("\n", "")
verbose_proxy_logger.warning(
"Failed to update spend counter %s in Redis after tag spend update: %s. "
"Budget checks may use stale value until counter expires.",
counter_key,
safe_counter_key,
redis_err,
)