scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-05 02:41:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 49

fix: extend request body param controls to cover cloud provider identity fields

Browse source
This commit is contained in:
Yuneng Jiang 2026-04-22 14:55:05 -07:00
parent 11391ebdec
commit a23f3c9c12
No known key found for this signature in database
1 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
litellm/proxy/auth/auth_utils.py
View file

@ -151,7 +151,28 @@ def is_request_body_safe(
A malicious user can set the api_base to their own domain and invoke POST /chat/completions to intercept and steal the OpenAI API key.
Relevant issue: https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997
"""
banned_params = ["api_base", "base_url", "user_config"]
banned_params = [
"api_base",
"base_url",
"user_config",
# Cloud provider credential params — these are deployment-level settings
# and must not be overridable from user-supplied request bodies.
"vertex_credentials",
"vertex_ai_credentials",
"vertex_project",
"vertex_ai_project",
"vertex_location",
"vertex_ai_location",
"aws_access_key_id",
"aws_secret_access_key",
"aws_session_token",
"aws_region_name",
"aws_profile_name",
"aws_role_name",
"aws_web_identity_token",
"azure_ad_token",
"azure_ad_token_provider",
]
for param in banned_params:
if (