From 64beb47c04b8f54d52115e5590046fc1516cbe44 Mon Sep 17 00:00:00 2001
From: "tyh.carl" <tyh.carl@gmail.com>
Date: Tue, 19 May 2026 16:57:57 +0800
Subject: [PATCH] fix(ui): validate window.location.href before use in
 EntityUsage open-tab links

Compute a safeHref that only passes through http/https URLs to prevent
DOM-based XSS via tainted window.location data in href sinks (items #4 and #5).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../UsagePage/components/EntityUsage/EntityUsage.tsx        | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/EntityUsage.tsx b/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/EntityUsage.tsx
index 9fa73dd1728..81c5f33910f 100644
--- a/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/EntityUsage.tsx
+++ b/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/EntityUsage.tsx
@@ -107,6 +107,8 @@ const EntityUsage: React.FC<EntityUsageProps> = ({ accessToken, entityType, enti
   const [topModelsLimit, setTopModelsLimit] = useState<number>(5);
   const [topAgentsLimit, setTopAgentsLimit] = useState<number>(5);
 
+  const safeHref = /^https?:\/\//.test(window.location.href) ? window.location.href : "/";
+
   const startTime = useMemo(() => (dateValue.from ? new Date(dateValue.from) : null), [dateValue.from]);
   const endTime = useMemo(() => (dateValue.to ? new Date(dateValue.to) : null), [dateValue.to]);
 
@@ -409,7 +411,7 @@ const EntityUsage: React.FC<EntityUsageProps> = ({ accessToken, entityType, enti
                 Currently fetching spend data: fetched {progress.currentPage} / {progress.totalPages} pages. Charts will
                 update periodically as data loads. Moving off of this page will stop and reset this. To continue using
                 the UI in the meantime,{" "}
-                <a href={window.location.href} target="_blank" rel="noopener noreferrer">
+                <a href={safeHref} target="_blank" rel="noopener noreferrer">
                   open a new tab <ExportOutlined />
                 </a>
                 .
@@ -445,7 +447,7 @@ const EntityUsage: React.FC<EntityUsageProps> = ({ accessToken, entityType, enti
                 Currently fetching agent data: fetched {agentProgress.currentPage} / {agentProgress.totalPages} pages.
                 Charts will update periodically as data loads. Moving off of this page will stop and reset this. To
                 continue using the UI in the meantime,{" "}
-                <a href={window.location.href} target="_blank" rel="noopener noreferrer">
+                <a href={safeHref} target="_blank" rel="noopener noreferrer">
                   open a new tab <ExportOutlined />
                 </a>
                 .