From c6bc4b1bc25968ffd4b441a23a14cf31cfcc8ecc Mon Sep 17 00:00:00 2001 From: Christian Sidak Date: Thu, 9 Apr 2026 19:51:15 -0700 Subject: [PATCH] Fix URL substring sanitization and remove unused imports - Replace raw 'services.ai.azure.com in api_base' substring check with _should_use_api_key_header() which uses urlparse + host.endswith() to prevent URL spoofing (CodeQL alert) - Remove unused imports: litellm, get_secret_str --- litellm/llms/azure_ai/responses/transformation.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/litellm/llms/azure_ai/responses/transformation.py b/litellm/llms/azure_ai/responses/transformation.py index d66a7a9d7af..af54a4fd594 100644 --- a/litellm/llms/azure_ai/responses/transformation.py +++ b/litellm/llms/azure_ai/responses/transformation.py @@ -12,11 +12,9 @@ from urllib.parse import urlparse import httpx -import litellm from litellm.llms.azure.common_utils import BaseAzureLLM from litellm.llms.azure_ai.common_utils import AzureFoundryModelInfo from litellm.llms.openai.responses.transformation import OpenAIResponsesAPIConfig -from litellm.secret_managers.main import get_secret_str from litellm.types.router import GenericLiteLLMParams from litellm.types.utils import LlmProviders from litellm.utils import _add_path_to_api_base @@ -120,7 +118,7 @@ class AzureAIResponsesAPIConfig(OpenAIResponsesAPIConfig): new_url = _add_path_to_api_base( api_base=api_base, ending_path="/openai/v1/responses" ) - elif "services.ai.azure.com" in api_base: + elif self._should_use_api_key_header(api_base): new_url = _add_path_to_api_base( api_base=api_base, ending_path="/models/responses" )