fix(proxy): block Claude Platform workspace id aliases in request bodies without admin opt-in

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

litellm/proxy/auth/auth_utils.py

@@ -338,6 +338,10 @@ _BANNED_REQUEST_BODY_PARAMS: Final[tuple[str, ...]] = (
     # re-route the request's retention and accounting to any project
     # reachable with the deployment's shared AWS credentials.
     "aws_bedrock_project_id",
+    "workspace_id",
+    "aws_workspace_id",
+    "anthropic_workspace_id",
+    "anthropic-workspace-id",
     "bedrock_tags",
     # Provider-specific endpoint overrides that flow into the outbound
     # request via ``optional_params``. Same threat as ``api_base``:

tests/test_litellm/proxy/auth/test_auth_utils.py

@@ -2727,6 +2727,30 @@ class TestIsRequestBodySafeBlocksBedrockProjectOverride:
         )
 
 
+class TestIsRequestBodySafeBlocksClaudePlatformWorkspaceOverride:
+    @pytest.mark.parametrize(
+        "alias", ["workspace_id", "aws_workspace_id", "anthropic_workspace_id", "anthropic-workspace-id"]
+    )
+    def test_workspace_alias_in_request_body_is_rejected(self, alias):
+        with pytest.raises(ValueError, match=alias):
+            is_request_body_safe(
+                request_body={"model": "gpt-4", alias: "wrkspc_attacker"},
+                general_settings={},
+                llm_router=None,
+                model="gpt-4",
+            )
+
+    def test_admin_opt_in_proxy_wide_allows_workspace_id(self):
+        assert (
+            is_request_body_safe(
+                request_body={"model": "gpt-4", "workspace_id": "wrkspc_byok"},
+                general_settings={"allow_client_side_credentials": True},
+                llm_router=None,
+                model="gpt-4",
+            )
+            is True
+        )
+
 class TestIsRequestBodySafeBlocksRustOptIn:
     """``rust`` hands the whole call to the Rust core, which signs and sends
     with its own HTTP client rather than the one the deployment configured, and