scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-27 01:22:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 80

fix(ui): validate pathname before assigning to window.location.href in handleError

Browse source 
Guard against non-root-relative paths to prevent DOM-based XSS via
tainted window.location data flowing into the href sink.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
tyh.carl 2026-05-19 16:50:57 +08:00
parent dfe4bf6cef
commit dcf3717b63
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ui/litellm-dashboard/src/components/networking.tsx
View file

@ -353,7 +353,10 @@ export const handleError = async (errorData: string | any) => {
clearTokenCookies();
const browserLocation = getWindowLocation();
if (browserLocation) {
window.location.href = browserLocation.pathname;
const pathname = browserLocation.pathname;
if (pathname.startsWith("/")) {
window.location.href = pathname;
}
}
}
lastErrorTime = currentTime;