From 6f150655c2caaaf2662918a3efc227e78659c19e Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Sun, 9 Aug 2026 13:35:11 +0700 Subject: [PATCH] fix(gigachat): keep TLS verify on image URL downloads safe_get relies on hostname-bound HTTPS when litellm.ssl_verify is on. Downloading with ssl_verify=False left a DNS-rebinding gap. Keep verify disabled only for GigaChat API upload clients. --- litellm/llms/gigachat/file_handler.py | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/litellm/llms/gigachat/file_handler.py b/litellm/llms/gigachat/file_handler.py index 3bf235a60a1..e6b83c9d6d1 100644 --- a/litellm/llms/gigachat/file_handler.py +++ b/litellm/llms/gigachat/file_handler.py @@ -53,9 +53,8 @@ def _parse_data_url(data_url: str) -> tuple[bytes, str, str] | None: def _download_image_sync(url: str) -> tuple[bytes, str, str]: - """Download image from URL synchronously with SSRF guards.""" - client: Final = _get_httpx_client(params={"ssl_verify": False}) - # Chat image_url is user/LLM controlled; use the shared redirect-aware guard. + """Download image from URL synchronously.""" + client: Final = _get_httpx_client() response: Final = safe_get(client, url) response.raise_for_status() @@ -66,11 +65,8 @@ def _download_image_sync(url: str) -> tuple[bytes, str, str]: async def _download_image_async(url: str) -> tuple[bytes, str, str]: - """Download image from URL asynchronously with SSRF guards.""" - client: Final = get_async_httpx_client( - llm_provider=LlmProviders.GIGACHAT, - params={"ssl_verify": False}, - ) + """Download image from URL asynchronously.""" + client: Final = get_async_httpx_client(llm_provider=LlmProviders.GIGACHAT) response: Final = await async_safe_get(client, url) response.raise_for_status() @@ -141,7 +137,6 @@ def upload_file_sync( return file_id except SSRFError: - # Fail closed: do not treat blocked URLs as a soft upload miss. raise except Exception as e: verbose_logger.error("Error uploading file to GigaChat: %s", e) @@ -212,7 +207,6 @@ async def upload_file_async( return file_id except SSRFError: - # Fail closed: do not treat blocked URLs as a soft upload miss. raise except Exception as e: verbose_logger.error("Error uploading file to GigaChat: %s", e)