scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-14 09:03:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 214

Merge 6763236aeb into 3f4dc93b40

Browse source
This commit is contained in:
Luuk Wubben 2026-11-05 07:35:47 +00:00 • committed by GitHub
commit 5c93f9424f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 86 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
litellm/proxy/guardrails/guardrail_hooks/litellm_content_filter/patterns.json
View file

@ -73,9 +73,9 @@
{
"name": "aws_secret_key",
"display_name": "AWS Secret Key",
"pattern": "\\b([A-Za-z0-9/+=]{40})\\b",
"pattern": "(?-i:(?<![A-Za-z0-9/+])(?=[A-Za-z0-9/+]*[a-z])(?=[A-Za-z0-9/+]*[A-Z])(?=[A-Za-z0-9/+]*[\\d/+])(?!(?:[a-z0-9]*(?:[A-Z][a-z0-9]+)*/){3,}[a-z0-9]*(?:[A-Z][a-z0-9]+)*(?![A-Za-z0-9/+]))[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+]))",
"category": "Credential Patterns",
"description": "Detects AWS secret keys (40 characters)"
"description": "Detects AWS secret keys (40-character base64)"
},
{
"name": "github_token",

84
tests/unit/proxy/guardrails/guardrail_hooks/content_filter/test_content_filter.py
View file

@ -404,6 +404,90 @@ class TestContentFilterGuardrail:
assert result is not None
assert result[1] == "aws_access_key"
def test_aws_secret_key_patterns(self):
"""
Test AWS Secret Key pattern detection for actual key
"""
patterns: Final = [
ContentFilterPattern(
pattern_type="prebuilt",
pattern_name="aws_secret_key",
action=ContentFilterAction.BLOCK,
),
]
guardrail: Final = ContentFilterGuardrail(
guardrail_name="test-aws-secret-key",
patterns=patterns,
)
result: Final = guardrail._check_patterns("My key is wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY")
assert result is not None
assert result[1] == "aws_secret_key"
def test_aws_secret_key_patterns_filepath(self):
"""
Test AWS Secret Key pattern detection to ensure it doesn't match long filepaths
"""
patterns: Final = [
ContentFilterPattern(
pattern_type="prebuilt",
pattern_name="aws_secret_key",
action=ContentFilterAction.BLOCK,
),
]
guardrail: Final = ContentFilterGuardrail(
guardrail_name="test-aws-secret-key-filepath",
patterns=patterns,
)
result: Final = guardrail._check_patterns("Please read the file at " +
"coding2/projects/files/others/file/coders.txt")
assert result is None
def test_aws_secret_key_patterns_slash_check(self):
"""
Test AWS Secret Key pattern detection to verify it rejects even with exactly 4 slashes
"""
patterns: Final = [
ContentFilterPattern(
pattern_type="prebuilt",
pattern_name="aws_secret_key",
action=ContentFilterAction.BLOCK,
),
]
guardrail: Final = ContentFilterGuardrail(
guardrail_name="test-aws-secret-key-slash-check",
patterns=patterns,
)
result: Final = guardrail._check_patterns("My key is w/alrXUtnFEMI/K7MDENG/bPxRfiCY/XAMPLEKEY")
assert result is not None
assert result[1] == "aws_secret_key"
def test_aws_secret_key_patterns_digit_check(self):
"""
Test AWS Secret Key pattern detection to verify it rejects even with no digits
"""
patterns: Final = [
ContentFilterPattern(
pattern_type="prebuilt",
pattern_name="aws_secret_key",
action=ContentFilterAction.BLOCK,
),
]
guardrail: Final = ContentFilterGuardrail(
guardrail_name="test-aws-secret-key-digit-check",
patterns=patterns,
)
result: Final = guardrail._check_patterns("My key is w/alrXUtnFEMI/KdMDENG/bPxRfiCY/XAMPLEKEY")
assert result is not None
assert result[1] == "aws_secret_key"
@pytest.mark.asyncio
async def test_streaming_hook_mask(self):
"""