litellm

mirror of https://github.com/BerriAI/litellm.git synced 2026-09-21 00:21:49 +00:00

History

user fc580ae1ec fix(videos): encode the variant query param ``variant`` is user-controlled (passed through from ``litellm.video_content(variant=...)``) and was interpolated raw into the URL query string. A value like ``thumbnail&extra=1`` would inject additional query parameters into the upstream request — the same class of issue this PR's path-segment encoding addresses. Wrap the value in ``quote(value, safe="")`` so ``&`` / ``=`` / ``#`` cannot terminate the ``variant`` value or open a new parameter. Adds a regression test asserting that a malicious ``thumbnail&extra=1`` ends up percent-encoded in the URL, and that the legitimate ``thumbnail`` value still round-trips cleanly.	2026-05-01 00:32:02 +00:00
..
test_openai_video_transformation.py	fix(videos): encode the variant query param	2026-05-01 00:32:02 +00:00

user fc580ae1ec fix(videos): encode the variant query param

``variant`` is user-controlled (passed through from
``litellm.video_content(variant=...)``) and was interpolated raw into
the URL query string.  A value like ``thumbnail&extra=1`` would inject
additional query parameters into the upstream request — the same
class of issue this PR's path-segment encoding addresses.  Wrap the
value in ``quote(value, safe="")`` so ``&`` / ``=`` / ``#`` cannot
terminate the ``variant`` value or open a new parameter.

Adds a regression test asserting that a malicious ``thumbnail&extra=1``
ends up percent-encoded in the URL, and that the legitimate
``thumbnail`` value still round-trips cleanly.

2026-05-01 00:32:02 +00:00

test_openai_video_transformation.py

fix(videos): encode the variant query param

2026-05-01 00:32:02 +00:00