From 99f8e1dcc7796fdff64063182fec50567b195f26 Mon Sep 17 00:00:00 2001 From: Shalom Jamil Date: Wed, 29 Apr 2026 14:04:32 +0300 Subject: [PATCH] fix sha256 --- .../guardrails/guardrail_hooks/ovalix/ovalix.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/litellm/proxy/guardrails/guardrail_hooks/ovalix/ovalix.py b/litellm/proxy/guardrails/guardrail_hooks/ovalix/ovalix.py index 7fc4475ac95..1cd7238e2bc 100644 --- a/litellm/proxy/guardrails/guardrail_hooks/ovalix/ovalix.py +++ b/litellm/proxy/guardrails/guardrail_hooks/ovalix/ovalix.py @@ -31,6 +31,9 @@ if TYPE_CHECKING: BLOCKED_BY_OVALIX_FALLBACK_MESSAGE = "This message was blocked by Ovalix" BLOCKED_ACTION_TYPE = "block" +# Fixed salt so actor/session fingerprints are deterministic per LiteLLM release salt version. +_OVALIX_TRACKER_ACTOR_SCRYPT_SALT = b"litellm-ovalix-tracker-actor-v1" + class OvalixGuardrailMissingSecrets(Exception): """Raised when required Ovalix config (API base, key, application/checkpoint IDs) is missing.""" @@ -179,8 +182,17 @@ class OvalixGuardrail(CustomGuardrail): return "unknown" def _get_tracker_actor_id(self, data: dict) -> str: - """Opaque actor id for Tracker API payloads (hash of _get_actor; avoids sending PII).""" - return hashlib.sha256(self._get_actor(data).encode()).hexdigest()[:8] + """Opaque actor id for Tracker API payloads (scrypt KDF of _get_actor; avoids sending PII).""" + material = self._get_actor(data).encode() + dk = hashlib.scrypt( + material, + salt=_OVALIX_TRACKER_ACTOR_SCRYPT_SALT, + n=16384, + r=8, + p=1, + dklen=32, + ) + return dk.hex()[:8] def _get_session_id(self, data: dict) -> str: """Return a unique identifier for the chat/session (actor + date + application_id)."""