Litellm azure ai dev fix #8857
Litellm azure ai dev fix #8857
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| """ | ||
| Returns True if the request should use `api-key` header for authentication. | ||
| """ | ||
| if "services.ai.azure.com" in api_base or "openai.azure.com" in api_base: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, we need to parse the URL and check the hostname explicitly rather than using a substring check. This ensures that the check is performed on the actual host part of the URL, preventing bypasses through embedding.
The best way to fix the problem without changing existing functionality is to use the urlparse function from the urllib.parse module to extract the hostname from the api_base URL and then check if it matches the allowed hosts.
We will modify the _should_use_api_key_header method to parse the URL and check the hostname. This change will be made in the file litellm/llms/azure_ai/chat/transformation.py.
| @@ -41,3 +41,6 @@ | ||
| """ | ||
| if "services.ai.azure.com" in api_base or "openai.azure.com" in api_base: | ||
| from urllib.parse import urlparse | ||
| parsed_url = urlparse(api_base) | ||
| host = parsed_url.hostname | ||
| if host and (host.endswith("services.ai.azure.com") or host.endswith("openai.azure.com")): | ||
| return True |
| """ | ||
| Returns True if the request should use `api-key` header for authentication. | ||
| """ | ||
| if "services.ai.azure.com" in api_base or "openai.azure.com" in api_base: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, we should parse the URL using a proper URL parsing library and then check the hostname to ensure it matches the expected domain. This approach is more robust and prevents the possibility of bypassing the check by embedding the allowed host in an unexpected location.
- We will use the
urlparsefunction from theurllib.parsemodule to parse the URL. - We will then check if the hostname of the parsed URL ends with the expected domain.
| @@ -4,2 +4,3 @@ | ||
| from httpx import Response | ||
| from urllib.parse import urlparse | ||
|
|
||
| @@ -41,3 +42,4 @@ | ||
| """ | ||
| if "services.ai.azure.com" in api_base or "openai.azure.com" in api_base: | ||
| parsed_url = urlparse(api_base) | ||
| if parsed_url.hostname and (parsed_url.hostname.endswith("services.ai.azure.com") or parsed_url.hostname.endswith("openai.azure.com")): | ||
| return True |
Title
Relevant issues
Type
🆕 New Feature
🐛 Bug Fix
🧹 Refactoring
📖 Documentation
🚄 Infrastructure
✅ Test
Changes
[REQUIRED] Testing - Attach a screenshot of any new tests passing locally
If UI changes, send a screenshot/GIF of working UI fixes