From d9a7666cb179ce3e3ca1eff45f62aaf74f2fc1c4 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 03:29:49 +0000
Subject: [PATCH] refactor(guardrails): drop explanatory comments per repo
 style

---
 .../guardrails/guardrail_hooks/custom_code/primitives.py  | 4 ----
 tests/test_litellm/litellm_core_utils/test_url_utils.py   | 8 +++-----
 .../proxy/guardrails/test_custom_code_primitives.py       | 4 ----
 3 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py b/litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py
index 05dca41de5c..7d5f35793e1 100644
--- a/litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py
+++ b/litellm/proxy/guardrails/guardrail_hooks/custom_code/primitives.py
@@ -472,10 +472,6 @@ async def http_request(
     json_body, data_body = _prepare_http_body(body)
 
     try:
-        # async_safe_request applies full SSRF protection (DNS resolution,
-        # private/cloud-metadata IP blocklist, anti-rebinding, per-hop redirect
-        # validation) and never follows redirects on its own, so it needs the
-        # raw httpx client rather than the AsyncHTTPHandler wrapper.
         response = await async_safe_request(
             client.client,
             method,
diff --git a/tests/test_litellm/litellm_core_utils/test_url_utils.py b/tests/test_litellm/litellm_core_utils/test_url_utils.py
index a0da5338811..10054488537 100644
--- a/tests/test_litellm/litellm_core_utils/test_url_utils.py
+++ b/tests/test_litellm/litellm_core_utils/test_url_utils.py
@@ -577,8 +577,9 @@ class TestAsyncSafeRequest:
 
     @pytest.mark.asyncio
     async def test_validates_each_redirect_hop(self, monkeypatch):
-        # First hostname resolves public; the redirect target resolves to a
-        # private IP and must be blocked before the second request is issued.
+        """A public host that redirects to a private target must be blocked at the
+        redirect hop before a second request is issued."""
+
         def fake(host, port, *a, **kw):
             ip = "93.184.216.34" if host == "public.example" else "127.0.0.1"
             return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", (ip, port))]
@@ -602,9 +603,6 @@ class TestAsyncSafeRequest:
             await url_utils.async_safe_request(
                 FakeClient(), "DELETE", "http://public.example/start"
             )
-        # Only the first (public) hop is issued; the private redirect target is
-        # rejected by validate_url before a second request goes out, and the
-        # method is preserved across the safe redirect loop.
         assert len(hops) == 1
         assert hops[0]["method"] == "DELETE"
         assert hops[0]["host"] == "public.example"
diff --git a/tests/test_litellm/proxy/guardrails/test_custom_code_primitives.py b/tests/test_litellm/proxy/guardrails/test_custom_code_primitives.py
index 34faf8b8606..98343972cb0 100644
--- a/tests/test_litellm/proxy/guardrails/test_custom_code_primitives.py
+++ b/tests/test_litellm/proxy/guardrails/test_custom_code_primitives.py
@@ -102,8 +102,6 @@ async def test_http_request_does_not_follow_redirect_to_private(monkeypatch):
 
     assert result["success"] is False
     assert "SSRF" in result["error"]
-    # Only the first (public) hop was attempted; the private redirect target was
-    # rejected before a second request went out.
     assert len(raw_client.calls) == 1
 
 
@@ -132,7 +130,5 @@ async def test_http_request_allows_public_host(monkeypatch):
     assert len(raw_client.calls) == 1
     call = raw_client.calls[0]
     assert call["method"] == "POST"
-    # HTTP target is rewritten to the validated IP; the original hostname rides
-    # in the Host header to defeat DNS rebinding.
     assert "93.184.216.34" in call["url"]
     assert call["headers"].get("Host") == "api.example.com"