scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-02 02:11:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 101

fix(guardrails): scan Anthropic tool_result content blocks

Browse source 
The Generic Guardrail API's _extract_input_text_and_images only read the
"text" key from list content blocks, so Anthropic tool_result blocks
(whose text lives under "content") were silently skipped. Tool outputs
such as file reads and API responses bypassed all guardrail scanning,
a PII/secret-leak gap in agentic workflows. Also handles the list form
of tool_result content (blocks of type text).
This commit is contained in:
Tai An 2026-06-03 09:12:26 -07:00
parent e182a5e0ba
commit d5cca6b97d
1 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
litellm/llms/anthropic/chat/guardrail_translation/handler.py
View file

@ -237,6 +237,24 @@ class AnthropicMessagesHandler(BaseTranslation):
texts_to_check.append(text_str)
task_mappings.append((msg_idx, int(content_idx)))
# Anthropic tool_result blocks carry their text under "content"
# (string or list of blocks), not "text". Without this, tool
# outputs (file reads, API responses) bypass guardrail scanning.
if content_item.get("type") == "tool_result":
tool_result_content = content_item.get("content")
if isinstance(tool_result_content, str):
texts_to_check.append(tool_result_content)
task_mappings.append((msg_idx, int(content_idx)))
elif isinstance(tool_result_content, list):
for block in tool_result_content:
if isinstance(block, dict):
block_text = block.get("text")
if block_text is not None:
texts_to_check.append(block_text)
task_mappings.append(
(msg_idx, int(content_idx))
)
# Extract images
if content_item.get("type") == "image":
source = content_item.get("source", {})