From 5ff7a019173adb27736f9e9235cd84d8be9d1c16 Mon Sep 17 00:00:00 2001 From: yuneng-jiang Date: Tue, 24 Mar 2026 08:58:12 -0700 Subject: [PATCH] address greptile review feedback (greploop iteration 5) - LoginPage: add '=' to SSO code validation regex to support base64-padded OAuth authorization codes Co-Authored-By: Claude Opus 4.6 (1M context) --- ui/litellm-dashboard/src/app/login/LoginPage.tsx | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ui/litellm-dashboard/src/app/login/LoginPage.tsx b/ui/litellm-dashboard/src/app/login/LoginPage.tsx index 178b6769a3c..45e08d4e5ec 100644 --- a/ui/litellm-dashboard/src/app/login/LoginPage.tsx +++ b/ui/litellm-dashboard/src/app/login/LoginPage.tsx @@ -47,10 +47,11 @@ function LoginPageContent() { // Exchange it for the JWT via the worker's /v3/login/exchange endpoint. const params = new URLSearchParams(window.location.search); const ssoCode = params.get("code"); - // Validate code format: only allow alphanumeric + common OAuth code characters. + // Validate code format: only allow alphanumeric + common OAuth code characters + // (including '=' for base64-padded authorization codes). // This prevents arbitrary user input from controlling subsequent logic and // satisfies CodeQL's user-controlled-bypass check. - const isValidSsoCode = ssoCode != null && /^[a-zA-Z0-9._~+\/-]{1,512}$/.test(ssoCode); + const isValidSsoCode = ssoCode != null && /^[a-zA-Z0-9._~+=\/-]{1,512}$/.test(ssoCode); if (isValidSsoCode) { const workerUrl = localStorage.getItem("litellm_worker_url"); exchangeLoginCode(ssoCode, workerUrl).then(() => {