scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-11 22:51:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 124

fix(purview_dlp): fail closed when stream_chunk_builder returns None

Browse source 
stream_chunk_builder can return None (e.g., when ChunkProcessor filters
all chunks), causing both isinstance checks to fail and the buffered
chunks to be released without DLP scanning. Explicitly fail closed in
that case by raising an HTTPException so the streaming DLP guardrail
does not bypass policy enforcement.

Co-authored-by: Yassin Kortam <yassin@berri.ai>
This commit is contained in:
Cursor Agent 2026-05-22 16:55:58 +00:00
parent 5876b826a8
commit 6bfd1f04cc
No known key found for this signature in database
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
litellm/proxy/guardrails/guardrail_hooks/microsoft_purview/purview_dlp.py
View file

@ -402,6 +402,19 @@ class MicrosoftPurviewDLPGuardrail(PurviewGuardrailBase, CustomGuardrail):
user_id = self._resolve_user_id_for_blocking(request_data, user_api_key_dict)
if assembled_response is None and all_chunks:
# Fail closed: stream_chunk_builder dropped all chunks, so we cannot
# scan the content. Refuse to release the buffered chunks.
raise HTTPException(
status_code=400,
detail={
"error": (
"Microsoft Purview DLP: Unable to assemble streamed "
"response for scanning; blocking response."
),
},
)
if isinstance(assembled_response, TextCompletionResponse):
parts = self._completion_response_text_parts(assembled_response)
if parts: