scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-08 22:21:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 78

Harden sensitive field handling, add Vault docs alert, relax URL validation

Browse source
This commit is contained in:
Ryan Crabbe 2026-03-04 17:14:51 -08:00
parent 9f36f59bcd
commit 6ab438bd6a
1 changed files with 27 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
ui/litellm-dashboard/src/components/Settings/AdminSettings/HashicorpVault/HashicorpVault.tsx
View file

@ -24,6 +24,7 @@ const FIELD_LABELS: Record<string, string> = {
approle_mount_path: "Mount Path",
client_cert: "Client Certificate",
client_key: "Client Key",
vault_cert_role: "Certificate Role",
};
interface FieldGroup {
@ -50,7 +51,7 @@ const FIELD_GROUPS: FieldGroup[] = [
{
title: "TLS",
subtitle: "Optional client certificate for mTLS.",
fields: ["client_cert", "client_key"],
fields: ["client_cert", "client_key", "vault_cert_role"],
},
];
@ -66,11 +67,10 @@ export default function HashicorpVault() {
const properties = schema?.properties ?? {};
const rawValues = data?.values ?? {};
// Strip masked sensitive values so form inputs start empty — users enter new values or leave blank to keep existing
// Never populate sensitive fields in the form — backend returns masked values that would be saved literally
const values: Record<string, any> = {};
for (const [key, value] of Object.entries(rawValues)) {
if (SENSITIVE_FIELDS.has(key) && typeof value === "string" && value.includes("*")) {
// Don't populate form with masked value — it would be saved literally
if (SENSITIVE_FIELDS.has(key)) {
continue;
}
values[key] = value;
@ -101,14 +101,14 @@ export default function HashicorpVault() {
const rules =
fieldName === "vault_addr"
? [{ type: "url" as const, message: "Please enter a valid URL" }]
? [{ pattern: /^https?:\/\/.+/, message: "Must start with http:// or https://" }]
: undefined;
const isSensitive = SENSITIVE_FIELDS.has(fieldName);
const maskedValue = rawValues[fieldName];
const hasExistingValue = isSensitive && typeof maskedValue === "string" && maskedValue.includes("*");
const existingValue = rawValues[fieldName];
const hasExistingValue = isSensitive && existingValue != null && existingValue !== "";
const placeholder = hasExistingValue
? `Current: ${maskedValue}`
? "Leave blank to keep existing"
: fieldSchema?.description;
return (
@ -144,6 +144,25 @@ export default function HashicorpVault() {
{schema.description}
</Typography.Paragraph>
)}
<Alert
type="info"
showIcon
message="Secrets must be stored with the field name &quot;key&quot;"
description={
<>
<Typography.Text code>
vault kv put secret/SECRET_NAME key=secret_value
</Typography.Text>
<br />
<Typography.Link
href="https://docs.litellm.ai/docs/secret_managers/hashicorp_vault"
target="_blank"
>
View documentation
</Typography.Link>
</>
}
/>
<Form key={JSON.stringify(values)} layout="vertical" initialValues={values} onFinish={handleSave}>
{FIELD_GROUPS.map((group, index) => (