scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-08 03:08:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 115

[Security Fix] fix: don't log JWT SSO token on .info() log (#15145)

Browse source 
* fix: get_redirect_response_from_openid

* fix info log check

* fix: forward_upstream_to_client
This commit is contained in:
Ishaan Jaff 2025-10-02 15:07:37 -07:00 • committed by Ishaan Jaffer
parent 4a5ea55d18
commit 4d95241397
2 changed files with 16 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
litellm/proxy/management_endpoints/ui_sso.py
View file

@ -1594,7 +1594,6 @@ class SSOAuthenticationHandler:
master_key or "",
algorithm="HS256",
)
verbose_proxy_logger.info(f"user_id: {user_id}; jwt_token: {jwt_token}")
if user_id is not None and isinstance(user_id, str):
litellm_dashboard_ui += "?login=success"
verbose_proxy_logger.info(f"Redirecting to {litellm_dashboard_ui}")

23
tests/code_coverage_tests/info_log_check.py
View file

@ -126,8 +126,13 @@ class SensitiveLogDetector(ast.NodeVisitor):
for value in arg.values:
if isinstance(value, ast.FormattedValue):
value_str = self._get_arg_string(value.value).lower()
if any(pattern in value_str for pattern in
['request', 'response', 'data', 'body', 'content', 'messages']):
# Check for any sensitive data patterns in f-string interpolations
sensitive_f_string_patterns = [
'request', 'response', 'data', 'body', 'content', 'messages',
'token', 'jwt', 'auth', 'api_key', 'apikey', 'credential',
'secret', 'password', 'passwd'
]
if any(pattern in value_str for pattern in sensitive_f_string_patterns):
return True
# Check for .format() calls
@ -137,10 +142,14 @@ class SensitiveLogDetector(ast.NodeVisitor):
base_str = self._get_arg_string(arg.func.value).lower()
if "{}" in base_str or "{" in base_str:
# Check format arguments for sensitive data
sensitive_format_patterns = [
'request', 'response', 'data', 'body', 'content',
'token', 'jwt', 'auth', 'api_key', 'apikey', 'credential',
'secret', 'password', 'passwd'
]
for format_arg in arg.args:
format_str = self._get_arg_string(format_arg).lower()
if any(pattern in format_str for pattern in
['request', 'response', 'data', 'body', 'content']):
if any(pattern in format_str for pattern in sensitive_format_patterns):
return True
return False
@ -171,7 +180,9 @@ class SensitiveLogDetector(ast.NodeVisitor):
"""Get a human-readable reason for the violation"""
arg_str = self._get_arg_string(arg).lower()
if 'request' in arg_str:
if any(pattern in arg_str for pattern in ['jwt', 'token', 'api_key', 'apikey', 'auth', 'credential', 'secret', 'password', 'passwd']):
return "Potentially logging authentication/secret data (JWT, token, API key, etc.)"
elif 'request' in arg_str:
return "Potentially logging request data"
elif 'response' in arg_str:
return "Potentially logging response data"
@ -179,8 +190,6 @@ class SensitiveLogDetector(ast.NodeVisitor):
return "Potentially logging sensitive data/body/content"
elif any(pattern in arg_str for pattern in ['messages', 'input', 'output']):
return "Potentially logging message/input/output data"
elif any(pattern in arg_str for pattern in ['api_key', 'token', 'auth', 'credentials']):
return "Potentially logging authentication data"
else:
return "Potentially logging sensitive data"