scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-13 23:11:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 100

address greptile review feedback (greploop iteration 5)

Browse source 
- LoginPage: add '=' to SSO code validation regex to support
  base64-padded OAuth authorization codes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
yuneng-jiang 2026-03-24 08:58:12 -07:00
parent 8180f0dfc1
commit 5ff7a01917
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ui/litellm-dashboard/src/app/login/LoginPage.tsx
View file

@ -47,10 +47,11 @@ function LoginPageContent() {
// Exchange it for the JWT via the worker's /v3/login/exchange endpoint.
const params = new URLSearchParams(window.location.search);
const ssoCode = params.get("code");
// Validate code format: only allow alphanumeric + common OAuth code characters.
// Validate code format: only allow alphanumeric + common OAuth code characters
// (including '=' for base64-padded authorization codes).
// This prevents arbitrary user input from controlling subsequent logic and
// satisfies CodeQL's user-controlled-bypass check.
const isValidSsoCode = ssoCode != null && /^[a-zA-Z0-9._~+\/-]{1,512}$/.test(ssoCode);
const isValidSsoCode = ssoCode != null && /^[a-zA-Z0-9._~+=\/-]{1,512}$/.test(ssoCode);
if (isValidSsoCode) {
const workerUrl = localStorage.getItem("litellm_worker_url");
exchangeLoginCode(ssoCode, workerUrl).then(() => {