diff --git a/litellm/proxy/common_request_processing.py b/litellm/proxy/common_request_processing.py index 0b9a2d5e4c0..0ea2109166e 100644 --- a/litellm/proxy/common_request_processing.py +++ b/litellm/proxy/common_request_processing.py @@ -67,7 +67,10 @@ if TYPE_CHECKING: ProxyConfig = _ProxyConfig else: ProxyConfig = Any -from litellm.proxy.litellm_pre_call_utils import add_litellm_data_to_request +from litellm.proxy.litellm_pre_call_utils import ( + add_litellm_data_to_request, + reject_url_valued_destination, +) from litellm.types.utils import ( ModelResponse, ModelResponseStream, @@ -1286,6 +1289,9 @@ class ProxyBaseLLMRequestProcessing: self.data[_metadata_variable_name] = {} self.data[_metadata_variable_name]["queue_time_seconds"] = queue_time_seconds + if isinstance(model, str): + reject_url_valued_destination("model", model) + self.data["model"] = ( general_settings.get("completion_model", None) # server default or user_model # model name passed via cli args diff --git a/litellm/proxy/image_endpoints/endpoints.py b/litellm/proxy/image_endpoints/endpoints.py index 587e1aad8f9..24ee1d96a0d 100644 --- a/litellm/proxy/image_endpoints/endpoints.py +++ b/litellm/proxy/image_endpoints/endpoints.py @@ -70,6 +70,7 @@ async def image_generation( user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth), model: str | None = None, ): + from litellm.proxy.litellm_pre_call_utils import reject_url_valued_destination from litellm.proxy.proxy_server import ( add_litellm_data_to_request, general_settings, @@ -96,6 +97,9 @@ async def image_generation( proxy_config=proxy_config, ) + if isinstance(model, str): + reject_url_valued_destination("model", model) + data["model"] = ( model or general_settings.get("image_generation_model", None) # server default diff --git a/litellm/proxy/litellm_pre_call_utils.py b/litellm/proxy/litellm_pre_call_utils.py index 5b0916b54c4..b00ba35b14e 100644 --- a/litellm/proxy/litellm_pre_call_utils.py +++ b/litellm/proxy/litellm_pre_call_utils.py @@ -262,29 +262,37 @@ def _reject_url_valued_destinations(data: dict[str, Any]) -> None: are unaffected, while admins can opt specific hosts back in via ``litellm.provider_url_destination_allowed_hosts``. """ - allowed_hosts: Final = getattr(litellm, "provider_url_destination_allowed_hosts", []) or [] for field in _URL_DESTINATION_REQUEST_FIELDS: value = data.get(field) - if not isinstance(value, str): + if isinstance(value, str): + reject_url_valued_destination(field, value) + + +def reject_url_valued_destination(field: str, value: str) -> None: + """Reject a URL-valued destination identifier unless admin-allowlisted. + + Operates on one field/value pair. ``_reject_url_valued_destinations`` applies + it across ``_URL_DESTINATION_REQUEST_FIELDS`` for a request body. + """ + allowed_hosts: Final = getattr(litellm, "provider_url_destination_allowed_hosts", []) or [] + for candidate in provider_url_destination_candidates(value): + if not candidate.lower().startswith(("http://", "https://")): continue - for candidate in provider_url_destination_candidates(value): - if not candidate.lower().startswith(("http://", "https://")): - continue - if is_url_destination_allowed_by_host(candidate, allowed_hosts): - continue - raise HTTPException( - status_code=400, - detail={ - "error": "invalid_request", - "param": field, - "message": ( - f"URL-valued '{field}' is not allowed. Configure custom " - "endpoints with api_base instead, or add the destination " - "host to `provider_url_destination_allowed_hosts` in " - "litellm_settings." - ), - }, - ) + if is_url_destination_allowed_by_host(candidate, allowed_hosts): + continue + raise HTTPException( + status_code=400, + detail={ + "error": "invalid_request", + "param": field, + "message": ( + f"URL-valued '{field}' is not allowed. Configure custom " + "endpoints with api_base instead, or add the destination " + "host to `provider_url_destination_allowed_hosts` in " + "litellm_settings." + ), + }, + ) def _strip_untrusted_request_header_controls( diff --git a/tests/test_litellm/proxy/image_endpoints/test_azure_routes.py b/tests/test_litellm/proxy/image_endpoints/test_azure_routes.py index 16fc6c19505..f5410ef0d70 100644 --- a/tests/test_litellm/proxy/image_endpoints/test_azure_routes.py +++ b/tests/test_litellm/proxy/image_endpoints/test_azure_routes.py @@ -120,3 +120,28 @@ def test_azure_image_edit_route(client_no_auth): assert called_kwargs["prompt"] == "A cute baby sea otter" assert response.status_code == 200 assert response.json()["data"] + + +def test_azure_image_generation_route_rejects_url_valued_path_model(client_no_auth): + """A URL-valued deployment segment is refused before any provider call.""" + client, mock_aimage_generation, _ = client_no_auth + response = client.post( + "/openai/deployments/oobabooga/https://example.invalid/images/generations", + json={"prompt": "A cute baby sea otter", "n": 1, "size": "1024x1024"}, + ) + + assert response.status_code == 400 + assert "URL-valued" in response.text + mock_aimage_generation.assert_not_called() + + +def test_azure_image_generation_route_allows_ordinary_path_model(client_no_auth): + """A deployment name that merely contains a provider prefix still routes.""" + client, mock_aimage_generation, _ = client_no_auth + response = client.post( + "/openai/deployments/dall-e-3/images/generations", + json={"prompt": "A cute baby sea otter", "n": 1, "size": "1024x1024"}, + ) + + assert response.status_code == 200 + mock_aimage_generation.assert_called_once() diff --git a/tests/test_litellm/proxy/test_provider_url_destination_guard.py b/tests/test_litellm/proxy/test_provider_url_destination_guard.py index c8771abbc8e..cd993a076e8 100644 --- a/tests/test_litellm/proxy/test_provider_url_destination_guard.py +++ b/tests/test_litellm/proxy/test_provider_url_destination_guard.py @@ -177,3 +177,16 @@ async def test_add_litellm_data_to_request_rejects_url_valued_model(): ) assert exc_info.value.status_code == 400 assert exc_info.value.detail["param"] == "model" + + +class TestNonStringDestinationValues: + """Only string identifiers are inspected. Anything else is left alone for the + request's normal validation to handle.""" + + @pytest.mark.parametrize("value", [123, None, True, {"a": 1}, ["x"], 1.5]) + def test_non_string_model_is_ignored(self, value): + _reject_url_valued_destinations({"model": value}) + + @pytest.mark.parametrize("value", [123, None, True, {"a": 1}, ["x"]]) + def test_non_string_file_id_is_ignored(self, value): + _reject_url_valued_destinations({"file_id": value})