scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-12 23:01:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 88

fix(hide-secrets): keep a comment or an indented header from closing an open value

Browse source
This commit is contained in:
Yucheng He 2026-09-07 23:16:41 -07:00
parent 0521663378
commit a0e1b280f0
2 changed files with 19 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
enterprise/litellm_enterprise/enterprise_callbacks/secret_detection.py
View file

@ -495,7 +495,17 @@ def _parseable_lines(text: str) -> Generator[str, None, None]:
if not stripped:
yield line
elif stripped[0] in "#;":
open_option = False
# configparser reads a comment inside a value without closing it, so leaving
# open_option alone keeps the indented lines under the comment reachable.
yield line
elif assignment is not None:
open_option = True
# Dedenting reaches the assignments inside a pasted config, and the line number
# keeps every key distinct so a config repeating api_key per model keeps them all.
yield f"{assignment.group()[:-1].strip()}_{number}{stripped[assignment.end() - 1:]}"
elif line[0].isspace() and open_option:
# An indented line inside an open value is part of that value to configparser,
# brackets included, so this has to be tested before the section header below.
yield line
elif stripped[0] == "[":
open_option = False
@ -503,13 +513,6 @@ def _parseable_lines(text: str) -> Generator[str, None, None]:
# it aborts the whole parse, taking every assignment below down with it.
if "]" in stripped[2:]:
yield line
elif assignment is not None:
open_option = True
# Dedenting reaches the assignments inside a pasted config, and the line number
# keeps every key distinct so a config repeating api_key per model keeps them all.
yield f"{assignment.group()[:-1].strip()}_{number}{stripped[assignment.end() - 1:]}"
elif line[0].isspace() and open_option:
yield line
else:
open_option = False

8
tests/test_litellm/enterprise/enterprise_callbacks/test_secret_detection.py
View file

@ -332,6 +332,10 @@ def test_scan_message_keeps_every_value_when_a_config_repeats_a_key():
("api_key: >\n aB3dE6gH9jK2mN5p", "aB3dE6gH9jK2mN5p"),
("api_key: |-\n aB3dE6gH9jK2mN5p", "aB3dE6gH9jK2mN5p"),
("secret= \\\n aB3dE6gH9jK2mN5p", "aB3dE6gH9jK2mN5p"),
("password =\n# rotate me\n Zx4Kp9Lm2Qr7Ns3Vt", "Zx4Kp9Lm2Qr7Ns3Vt"),
("api_key =\n; rotate me\n aB3dE6gH9jK2mN5p", "aB3dE6gH9jK2mN5p"),
(" # pasted from the vault\napi_key=aB3dE6gH9jK2mN5p", "aB3dE6gH9jK2mN5p"),
(" [db]\napi_key=aB3dE6gH9jK2mN5p", "aB3dE6gH9jK2mN5p"),
],
ids=[
"flat-assignment",
@ -344,6 +348,10 @@ def test_scan_message_keeps_every_value_when_a_config_repeats_a_key():
"yaml-folded-block",
"yaml-literal-block",
"backslash-continuation",
"comment-inside-a-value",
"semicolon-comment-inside-a-value",
"indented-comment-above",
"indented-section-header-above",
],
)
def test_scan_message_still_sees_assignments_sharing_a_message_with_a_vendor_key(