From 6137c16c0e4f915a6501f7f3f5e50b63bb4471ef Mon Sep 17 00:00:00 2001
From: "tyh.carl" <tyh.carl@gmail.com>
Date: Tue, 19 May 2026 17:08:37 +0800
Subject: [PATCH] fix(ui): validate baseUrl protocol before building SSO
 redirect URL in gotoLogin

Only allow http/https base URLs when constructing the window.location.href
target, falling back to a safe relative path to prevent DOM-based XSS (item #7).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 ui/litellm-dashboard/src/components/user_dashboard.tsx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ui/litellm-dashboard/src/components/user_dashboard.tsx b/ui/litellm-dashboard/src/components/user_dashboard.tsx
index db262bc84a1..4797dcb1db6 100644
--- a/ui/litellm-dashboard/src/components/user_dashboard.tsx
+++ b/ui/litellm-dashboard/src/components/user_dashboard.tsx
@@ -263,7 +263,8 @@ const UserDashboard: React.FC<UserDashboardProps> = ({
 
     console.log("proxyBaseUrl:", baseUrl);
 
-    const url = baseUrl ? `${baseUrl}/sso/key/generate` : `/sso/key/generate`;
+    const safeBase = baseUrl && /^https?:\/\//.test(baseUrl) ? baseUrl : "";
+    const url = safeBase ? `${safeBase}/sso/key/generate` : `/sso/key/generate`;
 
     console.log("Full URL:", url);
     window.location.href = url;