From 5b6ecab52d16963c7d33047fd3976f94e43b8b1d Mon Sep 17 00:00:00 2001 From: "devin-ai-integration[bot]" <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sat, 10 Oct 2026 14:03:33 -0700 Subject: [PATCH] fix(proxy): describe rejected characters in key_alias validation error (#41412) * fix(proxy): describe rejected characters in key_alias validation error Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): wrap key_alias validation error message Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Yuneng Jiang --- .../proxy/management_endpoints/key_management_endpoints.py | 5 ++++- .../management_endpoints/test_key_management_endpoints.py | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py index 6e226868918..782a7e1db3c 100644 --- a/litellm/proxy/management_endpoints/key_management_endpoints.py +++ b/litellm/proxy/management_endpoints/key_management_endpoints.py @@ -8040,7 +8040,10 @@ def _validate_key_alias_format(key_alias: str | None) -> None: raise_if_unsafe_secret_name(key_alias) except ValueError: raise ProxyException( - message="Invalid key_alias", + message=( + "Invalid key_alias: must not contain control characters (such as tab or newline) " + + 'or a ".." path segment' + ), type=ProxyErrorTypes.bad_request_error, param="key_alias", code=400, diff --git a/tests/unit/proxy/management_endpoints/test_key_management_endpoints.py b/tests/unit/proxy/management_endpoints/test_key_management_endpoints.py index 308558450b1..ee39df92ef2 100644 --- a/tests/unit/proxy/management_endpoints/test_key_management_endpoints.py +++ b/tests/unit/proxy/management_endpoints/test_key_management_endpoints.py @@ -10733,6 +10733,7 @@ class TestValidateKeyAliasFormat: "foo\n- !grant\n role: !!admin\n member: attacker", "foo\rbar", "foo\x00bar", + "my-test-key\t", ], ) def test_validate_key_alias_format_rejects_traversal_and_control_chars_even_when_flag_disabled( @@ -10751,6 +10752,8 @@ class TestValidateKeyAliasFormat: _validate_key_alias_format(unsafe_alias) assert str(exc.value.code) == "400" assert "Invalid key_alias" in str(exc.value.message) + assert "control characters" in str(exc.value.message) + assert '".." path segment' in str(exc.value.message) def test_validate_key_alias_format_valid(self, monkeypatch): from litellm.proxy.management_endpoints.key_management_endpoints import (