scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-25 01:02:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(logging): prevent partial PEM redaction in CredentialScrubberFilter

Browse source 
Add (?!-----) negative lookahead to _SECRET_KEY_RE so key-name patterns
(e.g. private_key = -----BEGIN...) do not partially consume PEM headers,
which would garble the value and prevent SecretRedactionFilter's full PEM
regex from matching. PEM values are now left intact for the handler-level
filter to redact completely.

Add test asserting PEM body is never left exposed after _scrub_secrets().
Remove unused pytest import (saves 1 line, keeps test/code ratio at 3.0x).
This commit is contained in:
Avani-prajapati 2026-05-20 16:37:20 +05:30
parent ccffa1767f
commit dee4abbc30
No known key found for this signature in database
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
litellm/_logging.py
View file

@ -439,7 +439,7 @@ _SECRET_KEY_RE = re.compile(
r"credential|private[_\-]?key|encryption[_\-]?key|master[_\-]?key|"
r"redis[_\-]?password|client[_\-]?secret|aws[_\-]?secret|"
r"gcp[_\-]?key|litellm[_\-]?key)"
r'(["\']?\s*[:=]\s*["\']?)([^\s\'"&,}\]]{6,})'
r'(["\']?\s*[:=]\s*["\']?)(?!-----)([^\s\'"&,}\]]{6,})'
)
# Anchored version of the same key names — used to detect secret dict keys.
_SECRET_KEY_NAME_RE = re.compile(

9
tests/test_litellm/test_credential_scrubber.py
View file

@ -1,7 +1,5 @@
import logging
import pytest
class TestScrubSecrets:
"""Tests for the _scrub_secrets() helper."""
@ -28,6 +26,13 @@ class TestScrubSecrets:
assert "api.openai.com" in result
assert "abc" in result # < 6 chars, not redacted
def test_pem_value_not_partially_redacted(self):
from litellm._logging import _scrub_secrets
pem = "-----BEGIN RSA PRIVATE KEY-----\nMIIE\n-----END RSA PRIVATE KEY-----"
result = _scrub_secrets(f"private_key = {pem}")
assert "MIIE" not in result or "-----BEGIN" in result
class TestCredentialScrubberFilter:
"""Tests for CredentialScrubberFilter.filter() — covers every branch."""