fix(anthropic): encode msgbatch ID in batch results URL

This commit is contained in:
Rana-Hassan7272 2026-07-02 20:03:47 +05:00
parent ed6cb9b4b3
commit ebeb782cd6
2 changed files with 16 additions and 1 deletions

View file

@ -272,8 +272,9 @@ class AnthropicFilesConfig(BaseFilesConfig):
or ANTHROPIC_FILES_API_BASE
)
if file_id and file_id.startswith("msgbatch_"):
encoded_batch_id = encode_url_path_segment(file_id, field_name="file_id")
return (
f"{api_base.rstrip('/')}/v1/messages/batches/{file_id}/results",
f"{api_base.rstrip('/')}/v1/messages/batches/{encoded_batch_id}/results",
{},
)

View file

@ -326,6 +326,20 @@ class TestAnthropicFilesConfig:
assert url == f"{ANTHROPIC_FILES_API_BASE}/v1/messages/batches/msgbatch_abc123/results"
assert params == {}
def test_transform_file_content_request_msgbatch_encodes_path_traversal(self):
url, params = self.config.transform_file_content_request(
file_content_request={
"file_id": "msgbatch_x/../../../v1/messages/batches?limit=1#frag"
},
optional_params={},
litellm_params={},
)
assert (
url
== f"{ANTHROPIC_FILES_API_BASE}/v1/messages/batches/msgbatch_x%2F..%2F..%2F..%2Fv1%2Fmessages%2Fbatches%3Flimit%3D1%23frag/results"
)
assert params == {}
def test_transform_file_content_response(self):
mock_response = Mock(spec=httpx.Response)
result = self.config.transform_file_content_response(