mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-20 00:11:50 +00:00
90fd791e0d
Greptile follow-ups on the prior commit: - (P1) ``is_request_body_safe`` recursed into ``litellm_embedding_config`` with no depth bound, so a request body 1000 levels deep could exhaust Python's call stack and surface a 500 ``RecursionError``. Refactored the check to be iterative (single-level descent into a fixed list of nested-config keys) and extracted the per-dict banned-param scan into a helper that's shared between the root and the nested call sites. Also fixes the ``recursive_detector`` CI job that was triggered by the recursive-by-name pattern. - (P2) ``assert_same_origin`` error messages identified the mismatching component but echoed the ``expected`` host and the candidate hostname back to the caller. In the SSRF threat model the caller is the attacker, so reflecting that information was a secondary leak of operator infrastructure. Messages now identify only *which* component mismatched (scheme / host / port) without naming names. - (P2) ``_NESTED_CONFIG_KEYS`` was defined after the function that used it. Hoisted the constant (and the new ``_BANNED_REQUEST_BODY_PARAMS`` tuple) above the function for readability. Adds a 1000-level-deep nested config test that asserts no ``RecursionError`` and a hostname-leak test that asserts no operator host appears in the rejection message. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| test_auth_checks.py | ||
| test_auth_exception_handler.py | ||
| test_auth_hot_path_network_requests.py | ||
| test_auth_utils.py | ||
| test_cli_auth.py | ||
| test_custom_auth_end_user_budget.py | ||
| test_handle_jwt.py | ||
| test_info_routes.py | ||
| test_litellm_license.py | ||
| test_login_utils.py | ||
| test_mcp_ip_filtering.py | ||
| test_model_checks.py | ||
| test_model_checks_fallbacks.py | ||
| test_multi_budget_windows.py | ||
| test_object_permission_loading.py | ||
| test_onboarding.py | ||
| test_organization_budget_enforcement.py | ||
| test_password_hashing.py | ||
| test_route_checks.py | ||
| test_team_member_budget.py | ||
| test_unmapped_model_budget_enforcement.py | ||
| test_user_api_key_auth.py | ||