scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-27 01:22:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 81

fix(ui): validate protocol in useBaseUrl to prevent DOM-based XSS

Browse source 
Only allow http: or https: protocols when constructing the base URL
from window.location, blocking javascript: and data: scheme injection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
tyh.carl 2026-05-19 15:52:03 +08:00
parent 0290c7bc00
commit dfe4bf6cef
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
ui/litellm-dashboard/src/components/constants.tsx
View file

@ -7,7 +7,9 @@ export const useBaseUrl = () => {
useEffect(() => {
if (typeof window !== "undefined") {
const { protocol, host } = window.location;
setBaseUrl(`${protocol}//${host}`);
if (protocol === "http:" || protocol === "https:") {
setBaseUrl(`${protocol}//${host}`);
}
}
}, []); // Removed router dependency