scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-25 01:02:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(auth): address remaining greptile style findings

Browse source 
- get_request_route: require root_path to match whole path segments before
  stripping, so '/apifoo' isn't truncated to 'foo' when root_path='/api'.
- get_mcp_client_ip: collapse the two trusted-proxy validation branches into
  a single is_request_from_trusted_proxy call so the return value drives
  control flow instead of being discarded for the side-effect warning.

Co-authored-by: Claude <claude@anthropic.com>
This commit is contained in:
Claude 2026-05-20 16:59:07 +00:00
parent 1e5053adf1
commit a6492bf424
No known key found for this signature in database
2 changed files with 17 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
litellm/proxy/auth/auth_utils.py
View file

@ -511,11 +511,13 @@ def get_request_route(request: Request) -> str:
).rstrip("/")
if not isinstance(raw_path, str):
return str(request.url.path)
# Only strip root_path when it is a meaningful prefix. Trailing
# slashes are stripped above so the result always keeps its leading
# "/" — stripping a bare "/" or "/prefix/" would otherwise produce
# paths like "team/new" and break route matching.
if root_path and raw_path.startswith(root_path):
# Strip root_path only when it matches whole path segments — guarding
# against sibling paths like "/apifoo" being truncated under
# root_path="/api". Trailing slashes on root_path are stripped above,
# so bare "/" or "/prefix/" still leave the leading "/" intact.
if root_path and (
raw_path == root_path or raw_path.startswith(root_path + "/")
):
return raw_path[len(root_path) :]
return raw_path
except Exception as e:

26
litellm/proxy/auth/ip_address_utils.py
View file

@ -200,21 +200,15 @@ class IPAddressUtils:
# If XFF is enabled, validate the request comes from a trusted proxy
if use_xff and "x-forwarded-for" in request.headers:
trusted_ranges = general_settings.get("mcp_trusted_proxy_ranges")
if not trusted_ranges:
IPAddressUtils.is_request_from_trusted_proxy(
request, general_settings=general_settings
)
if not IPAddressUtils.is_request_from_trusted_proxy(
request, general_settings=general_settings
):
direct_ip = request.client.host if request.client else None
if general_settings.get("mcp_trusted_proxy_ranges"):
# Direct connection isn't in any configured trusted CIDR.
verbose_proxy_logger.warning(
"XFF header from untrusted IP %s, ignoring", direct_ip
)
return direct_ip
return _get_request_ip_address(request, use_x_forwarded_for=False)
# Validate direct connection is from trusted proxy
direct_ip = request.client.host if request.client else None
trusted_networks = IPAddressUtils.parse_trusted_proxy_networks(
trusted_ranges
)
if not IPAddressUtils.is_trusted_proxy(direct_ip, trusted_networks):
# Untrusted source trying to set XFF - ignore XFF, use direct IP
verbose_proxy_logger.warning(
"XFF header from untrusted IP %s, ignoring", direct_ip
)
return direct_ip
return _get_request_ip_address(request, use_x_forwarded_for=use_xff)