scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-10 03:28:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 85

fix: escape user-controlled greeting in max budget alert email template

Browse source 
html.escape() the greeting (user_email/key_alias/token fallback) before
inserting into HTML email body to prevent HTML injection via key_alias.
This commit is contained in:
Ryan Crabbe 2026-04-17 18:52:13 -07:00
parent 44eb2ea56e
commit c1503d3088
No known key found for this signature in database
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
enterprise/litellm_enterprise/enterprise_callbacks/send_emails/base_email.py
View file

@ -3,6 +3,7 @@ Base class for sending emails to user after creating keys or invite links
"""
import html
import json
import os
from typing import List, Literal, Optional
@ -366,7 +367,9 @@ class BaseEmailLogger(CustomLogger):
user_email=event.user_email or recipient_emails[0],
event_message=event.event_message,
)
greeting = event.user_email or event.key_alias or event.token or ""
greeting = html.escape(
event.user_email or event.key_alias or event.token or ""
)
email_html_content = MAX_BUDGET_ALERT_EMAIL_TEMPLATE.format(
email_logo_url=email_params.logo_url,
recipient_email=greeting,