From dfe4bf6cefea0d7a213ff4cc202a7371808d182e Mon Sep 17 00:00:00 2001
From: "tyh.carl" <tyh.carl@gmail.com>
Date: Tue, 19 May 2026 15:52:03 +0800
Subject: [PATCH] fix(ui): validate protocol in useBaseUrl to prevent DOM-based
 XSS

Only allow http: or https: protocols when constructing the base URL
from window.location, blocking javascript: and data: scheme injection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 ui/litellm-dashboard/src/components/constants.tsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/litellm-dashboard/src/components/constants.tsx b/ui/litellm-dashboard/src/components/constants.tsx
index a9a38806c68..c56b382f577 100644
--- a/ui/litellm-dashboard/src/components/constants.tsx
+++ b/ui/litellm-dashboard/src/components/constants.tsx
@@ -7,7 +7,9 @@ export const useBaseUrl = () => {
   useEffect(() => {
     if (typeof window !== "undefined") {
       const { protocol, host } = window.location;
-      setBaseUrl(`${protocol}//${host}`);
+      if (protocol === "http:" || protocol === "https:") {
+        setBaseUrl(`${protocol}//${host}`);
+      }
     }
   }, []); // Removed router dependency