scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-27 01:22:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(ui): validate window.location.href before use in EntityUsage open-tab links

Browse source 
Compute a safeHref that only passes through http/https URLs to prevent
DOM-based XSS via tainted window.location data in href sinks (items #4 and #5).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
tyh.carl 2026-05-19 16:57:57 +08:00
parent dcf3717b63
commit 64beb47c04
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/EntityUsage.tsx
View file

@ -107,6 +107,8 @@ const EntityUsage: React.FC<EntityUsageProps> = ({ accessToken, entityType, enti
const [topModelsLimit, setTopModelsLimit] = useState<number>(5);
const [topAgentsLimit, setTopAgentsLimit] = useState<number>(5);
const safeHref = /^https?:\/\//.test(window.location.href) ? window.location.href : "/";
const startTime = useMemo(() => (dateValue.from ? new Date(dateValue.from) : null), [dateValue.from]);
const endTime = useMemo(() => (dateValue.to ? new Date(dateValue.to) : null), [dateValue.to]);
@ -409,7 +411,7 @@ const EntityUsage: React.FC<EntityUsageProps> = ({ accessToken, entityType, enti
Currently fetching spend data: fetched {progress.currentPage} / {progress.totalPages} pages. Charts will
update periodically as data loads. Moving off of this page will stop and reset this. To continue using
the UI in the meantime,{" "}
<a href={window.location.href} target="_blank" rel="noopener noreferrer">
<a href={safeHref} target="_blank" rel="noopener noreferrer">
open a new tab <ExportOutlined />
</a>
.
@ -445,7 +447,7 @@ const EntityUsage: React.FC<EntityUsageProps> = ({ accessToken, entityType, enti
Currently fetching agent data: fetched {agentProgress.currentPage} / {agentProgress.totalPages} pages.
Charts will update periodically as data loads. Moving off of this page will stop and reset this. To
continue using the UI in the meantime,{" "}
<a href={window.location.href} target="_blank" rel="noopener noreferrer">
<a href={safeHref} target="_blank" rel="noopener noreferrer">
open a new tab <ExportOutlined />
</a>
.