From ebeb782cd639968158f614379c1b95635105d1df Mon Sep 17 00:00:00 2001 From: Rana-Hassan7272 Date: Thu, 2 Jul 2026 20:03:47 +0500 Subject: [PATCH] fix(anthropic): encode msgbatch ID in batch results URL --- litellm/llms/anthropic/files/transformation.py | 3 ++- .../files/test_anthropic_files_transformation.py | 14 ++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/litellm/llms/anthropic/files/transformation.py b/litellm/llms/anthropic/files/transformation.py index 57466c2f3f0..e9ffd853692 100644 --- a/litellm/llms/anthropic/files/transformation.py +++ b/litellm/llms/anthropic/files/transformation.py @@ -272,8 +272,9 @@ class AnthropicFilesConfig(BaseFilesConfig): or ANTHROPIC_FILES_API_BASE ) if file_id and file_id.startswith("msgbatch_"): + encoded_batch_id = encode_url_path_segment(file_id, field_name="file_id") return ( - f"{api_base.rstrip('/')}/v1/messages/batches/{file_id}/results", + f"{api_base.rstrip('/')}/v1/messages/batches/{encoded_batch_id}/results", {}, ) diff --git a/tests/test_litellm/llms/anthropic/files/test_anthropic_files_transformation.py b/tests/test_litellm/llms/anthropic/files/test_anthropic_files_transformation.py index ddd9fae1ba5..20a40e60dce 100644 --- a/tests/test_litellm/llms/anthropic/files/test_anthropic_files_transformation.py +++ b/tests/test_litellm/llms/anthropic/files/test_anthropic_files_transformation.py @@ -326,6 +326,20 @@ class TestAnthropicFilesConfig: assert url == f"{ANTHROPIC_FILES_API_BASE}/v1/messages/batches/msgbatch_abc123/results" assert params == {} + def test_transform_file_content_request_msgbatch_encodes_path_traversal(self): + url, params = self.config.transform_file_content_request( + file_content_request={ + "file_id": "msgbatch_x/../../../v1/messages/batches?limit=1#frag" + }, + optional_params={}, + litellm_params={}, + ) + assert ( + url + == f"{ANTHROPIC_FILES_API_BASE}/v1/messages/batches/msgbatch_x%2F..%2F..%2F..%2Fv1%2Fmessages%2Fbatches%3Flimit%3D1%23frag/results" + ) + assert params == {} + def test_transform_file_content_response(self): mock_response = Mock(spec=httpx.Response) result = self.config.transform_file_content_response(