mirror of
https://github.com/BerriAI/litellm.git
synced 2026-11-15 09:12:18 +00:00
8decbe4801
* fix(bedrock): send s3:// image, document and video URLs to Converse as S3 sources An s3:// URL in an image_url or file part now becomes a Converse s3Location source instead of failing with "Unsupported image type". The format comes from the part's format or the key's extension, an optional bucket_owner is sent as bucketOwner, and an unknown or unsupported format answers 400. An image in an assistant turn no longer crashes the async path. * fix(proxy): limit non-admin s3:// media to allowed buckets and refuse managed prefixes A non-admin key may only send an s3:// media URL whose bucket is listed in general_settings.allowed_client_side_s3_buckets (or when client-side credentials are allowed), and never one under litellm's managed prefixes. Proxy admins are not limited. A bucket_owner on an s3:// URL that is not a non-empty string is a 400, the Responses bridge forwards the owner only for s3:// URLs, audio on S3 is a 400, and video in a tool result is sent to Bedrock. * fix(proxy): check s3:// media in every request field and refuse it in Bedrock batch files The s3:// media check now reads the whole request body instead of a fixed list of fields, and it also reads Gemini file_uri and fileUri, so a /v1beta generateContent request with an s3:// file part gets the same bucket rules as chat, Responses, and Anthropic requests. A Bedrock batch input line with an s3:// media URL is a 400 before upload, since Bedrock batch files do not take s3:// media URLs yet. * fix(bedrock): say that LiteLLM refuses s3:// media in Bedrock batch files The 400 for a Bedrock batch input line with an s3:// media URL now says "LiteLLM does not accept s3:// media URLs in Bedrock batch files", since Bedrock batch takes S3 locations and it is LiteLLM that refuses the line. * fix(proxy): check s3:// URLs only inside media parts and refuse them only on Converse batch lines The s3:// bucket check now reads URL fields only inside the content parts that a Bedrock transform turns into an S3 source, and it uses the same s3:// test as the prompt factory. Values in metadata, annotations, tool arguments and other fields pass as before. Each URL is named once in the 403 and 400 messages Bedrock batch files refuse s3:// media only on the lines that go through the Converse transform, so passthrough-provider lines upload unchanged * test(proxy): check that a media part's non-URI fields never count as s3 media * fix(proxy): check s3 URIs inside encoded file ids and on queued chat completions The s3 media check now decodes model-embedded and unified file ids, since completion() turns them back into the raw s3 URI they carry. The /queue/chat/completions endpoint skips common request processing, so it now runs the same check. The media walk goes level by level instead of recursing, which the recursive_detector code-quality step requires. * fix(proxy): let a key send managed file ids it may read and refuse s3 sources hidden in model_file_id_mapping The s3 media gate refused every LiteLLM managed file id whose upload sits under the managed prefix, even when the key's own user or team created it. It now asks the managed files hook which unified ids the key may read and skips only the objects those ids embed. A forged or unowned id, or a proxy without the hook, still gets a 403. The gate also reads the provider file ids in a client-supplied model_file_id_mapping, so an alias can no longer point a non-admin request at an unlisted or managed object. Markdown documents (.md, .markdown) now map to Bedrock's md document format, so an s3 Markdown source without an explicit format no longer fails with an unknown media type. * fix(proxy): check s3 media on every Responses WebSocket frame and keep inline tool-result video dropped Every response.create frame on WS /v1/responses now runs the same s3 media check as HTTP, so a non-admin key can no longer send an unlisted or managed s3 object over a WebSocket A tool result forwards a video to Bedrock only when it is an s3Location. An inline base64 video is dropped with a warning, as it was before this PR, since Converse rejects video in a toolResult block A non-admin key that sends an AWS identity its deployment admits through configurable_clientside_auth_params (aws_role_name, aws_web_identity_token or aws_profile_name) skips the bucket list, because Bedrock then reads the object with that identity. The managed-prefix 403 still applies. A WebSocket frame's own AWS identity fields never open the bucket list, since the managed WebSocket handler does not forward them and Bedrock reads with the deployment's identity The check now skips the body walk when no string starts with s3:// and no file_id or model_file_id_mapping key is present, which keeps large image bodies cheap * fix(proxy): let a client AWS identity skip the s3 bucket list only when Bedrock signs with it An admitted aws_role_name, aws_web_identity_token or aws_profile_name now skips the bucket list only when it decides the credentials get_credentials picks, on every deployment of the model group. A web identity token without a role and a session name does not, since get_credentials then ignores it. A profile does not when the deployment or the environment sets a role, since the role branch runs first. In those cases Bedrock still reads with the proxy's credentials, so the bucket list applies BaseAWSLLM.identity_choosing_params mirrors the branch order of get_credentials, and both read the same AWS_* environment fallbacks through one helper * fix(proxy): keep the s3 bucket list for non-admin keys that send a client AWS identity A client AWS identity field does not prove that the caller can read the bucket. A role or profile name picks credentials the proxy holds, and Bedrock reads the object with them. So the bucket list now applies to every non-admin s3 media part, whatever AWS identity fields the request sends. allow_client_side_credentials: true still turns it off This removes BaseAWSLLM.identity_choosing_params and the router lookup that only the skip needed * fix(proxy): look up managed file ids only when they can change the s3 refusal * fix(bedrock): check every file id field, skip MCP tool calls, accept registered S3 media types * fix(proxy): refuse unlisted s3 media on the rag query and adapter routes * style(proxy): format the merged collections.abc import * fix(proxy): walk tuples when checking s3 media and skip plain number lists * fix(proxy): skip numbers when walking a request body for s3 media A body with large token-id lists and any s3:// string or file_id key made the full walk build a node per number, taking seconds per request. The walk and its prefilter now skip int, float, bool and None values. * test(proxy): check the s3 refusal through the real request setup * test(proxy): exercise real setup for allowed s3 media Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(model-armor): fail closed on remote s3 documents Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(proxy): suppress cyclic fallback payload inference Limit the suppression to reportGeneralTypeIssues on the legacy payload assignment. The fallback payload is constructed as a dict and the runtime AST is unchanged Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_rag_endpoints.py | ||
| test_upload_security.py | ||