scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-12 03:48:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 57

fix(ui): keep the Decisions cURL key placeholder shell-expandable

Browse source 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
mateo 2026-10-11 05:34:11 +00:00
parent ea47f9590b
commit b5f52c91a8
2 changed files with 22 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
ui/litellm-dashboard/src/app/(dashboard)/playground/components/systemOneUI/lib/curlCommand.test.ts
View file

@ -1,3 +1,4 @@
import { execFileSync } from "node:child_process";
import { describe, expect, it } from "vitest";
import { buildCurlCommand, curlPayload } from "./curlCommand";
@ -12,7 +13,7 @@ describe("buildCurlCommand", () => {
const command = buildCurlCommand(input);
expect(command).toContain("curl -X POST 'http://localhost:4000/v1/systemone'");
expect(command).toContain("-H 'Authorization: Bearer $LITELLM_API_KEY'");
expect(command).toContain('-H "Authorization: Bearer $LITELLM_API_KEY"');
expect(command).not.toContain("sk-");
expect(command).toContain(' "state": "it\'\\\'\'s broken"');
expect(JSON.parse(curlPayload(command) ?? "")).toEqual({ model: "jev-latest", state: "it's broken" });
@ -37,10 +38,26 @@ describe("buildCurlCommand", () => {
authHeaderName: "X-Litellm-Key",
};
const command = buildCurlCommand(input);
expect(command).toContain("-H 'X-Litellm-Key: Bearer $LITELLM_API_KEY'");
expect(command).toContain('-H "X-Litellm-Key: Bearer $LITELLM_API_KEY"');
expect(command).not.toContain("Authorization");
});
it("lets the shell expand the key while a hostile header name stays literal", () => {
const input = {
baseUrl: "https://proxy.example",
endpoint: "/v1/systemone" as const,
payload: "{}",
authHeaderName: 'X-"$(touch pwned)`id`\\Key',
};
const command = buildCurlCommand(input);
const args = execFileSync("bash", ["-c", command.replace(/^curl /, "printf '%s\\n' ")], {
encoding: "utf8",
env: { ...process.env, LITELLM_API_KEY: "sk-test-key" },
});
expect(args).toContain('X-"$(touch pwned)`id`\\Key: Bearer sk-test-key\n');
expect(args).not.toContain("$LITELLM_API_KEY");
});
it("passes a payload that is not JSON through untouched", () => {
const input = {
baseUrl: "https://proxy.example",

4
ui/litellm-dashboard/src/app/(dashboard)/playground/components/systemOneUI/lib/curlCommand.ts
View file

@ -9,6 +9,8 @@ export const CURL_KEY_PLACEHOLDER = "$LITELLM_API_KEY";
const shellSingleQuote = (value: string): string => `'${value.replace(/'/g, `'\\''`)}'`;
const shellDoubleQuoteLiteral = (value: string): string => value.replace(/["\\$`]/g, (char) => `\\${char}`);
const prettyPayload = (payload: string): string => {
try {
return JSON.stringify(JSON.parse(payload), null, 2);
@ -20,7 +22,7 @@ const prettyPayload = (payload: string): string => {
export const buildCurlCommand = ({ baseUrl, endpoint, payload, authHeaderName }: CurlCommandInput): string =>
[
`curl -X POST ${shellSingleQuote(`${baseUrl.replace(/\/+$/, "")}${endpoint}`)}`,
` -H ${shellSingleQuote(`${authHeaderName}: Bearer ${CURL_KEY_PLACEHOLDER}`)}`,
` -H "${shellDoubleQuoteLiteral(authHeaderName)}: Bearer ${CURL_KEY_PLACEHOLDER}"`,
` -H "Content-Type: application/json"`,
` -d ${shellSingleQuote(prettyPayload(payload))}`,
].join(" \\\n");