mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-27 01:22:18 +00:00
842c423ccd
#34940 widened the mask-in-place safety guard so a Responses-API `instructions` field (and a combined messages+input body) skips the PII masking branch. With `on_flagged: "monitor"` that fell straight through to "allow", so PII that used to be masked now reaches the model unredacted. Monitor means "don't block", not "don't redact". Recover the one shape whose payload is still fully writable: mask it and write the redacted instructions back into `data["instructions"]` directly, since apply_redacted_messages_back has no path for that field and would otherwise fold the instructions text into `data["input"]`. The combined messages+input and multimodal shapes stay unmasked - both are unsafe to write back, not merely unwritable - and now log an error naming the reason instead of passing silently. No block/allow decision changes: block and inject_system_message keep the exact outcomes #34940 shipped. |
||
|---|---|---|
| .. | ||
| guardrail_hooks | ||
| test_content_filter_path_traversal.py | ||
| test_content_utils.py | ||
| test_custom_code_security.py | ||
| test_deferred_guardrail_logging.py | ||
| test_guardrail_coverage.py | ||
| test_guardrail_endpoints.py | ||
| test_guardrail_registry.py | ||
| test_init_guardrails.py | ||
| test_llm_as_a_judge.py | ||
| test_mcp_jwt_signer.py | ||
| test_pillar_guardrails.py | ||
| test_prompt_security_guardrails.py | ||
| test_qostodian_nexus_guardrail.py | ||
| test_usage_endpoints.py | ||
| test_usage_tracking.py | ||