fix(proxy): describe rejected characters in key_alias validation error (#41412)

* fix(proxy): describe rejected characters in key_alias validation error

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* fix(proxy): wrap key_alias validation error message

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: Yuneng Jiang <yuneng@berri.ai>

litellm/proxy/management_endpoints/key_management_endpoints.py

@@ -8040,7 +8040,10 @@ def _validate_key_alias_format(key_alias: str | None) -> None:
         raise_if_unsafe_secret_name(key_alias)
     except ValueError:
         raise ProxyException(
-            message="Invalid key_alias",
+            message=(
+                "Invalid key_alias: must not contain control characters (such as tab or newline) "
+                + 'or a ".." path segment'
+            ),
             type=ProxyErrorTypes.bad_request_error,
             param="key_alias",
             code=400,

tests/unit/proxy/management_endpoints/test_key_management_endpoints.py

@@ -10733,6 +10733,7 @@ class TestValidateKeyAliasFormat:
             "foo\n- !grant\n  role: !!admin\n  member: attacker",
             "foo\rbar",
             "foo\x00bar",
+            "my-test-key\t",
         ],
     )
     def test_validate_key_alias_format_rejects_traversal_and_control_chars_even_when_flag_disabled(
@@ -10751,6 +10752,8 @@ class TestValidateKeyAliasFormat:
             _validate_key_alias_format(unsafe_alias)
         assert str(exc.value.code) == "400"
         assert "Invalid key_alias" in str(exc.value.message)
+        assert "control characters" in str(exc.value.message)
+        assert '".." path segment' in str(exc.value.message)
 
     def test_validate_key_alias_format_valid(self, monkeypatch):
         from litellm.proxy.management_endpoints.key_management_endpoints import (