ai-workspace-services/litellm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1bb04cdc72
litellm/litellm
History
user 1bb04cdc72 fix(mcp): close redirect bypass + empty-getaddrinfo gap on SSRF guard 
Three follow-ups to the OAuth-discovery SSRF guard:

1. Greptile P1 (redirect bypass): the validated origin could return a
   3xx whose ``Location`` points at an internal address, and httpx
   would follow without re-checking the new target.  Pass
   ``follow_redirects=False`` to both gated httpx GETs.  Spec-compliant
   OAuth/OIDC metadata endpoints serve the JSON directly, so this
   doesn't affect legitimate providers.

2. Greptile P2 (empty getaddrinfo): POSIX doesn't strictly forbid an
   empty success-list from ``getaddrinfo``.  Add an explicit
   ``if not infos: return False`` so the guard fails closed instead of
   falling through to ``return True``.

3. Mypy: ``info[4][0]`` is typed ``str | int``; narrow at the
   boundary with an ``isinstance`` check (fail-closed if non-str).

Adds two regression tests verifying ``follow_redirects=False`` is
passed at both gated fetch sites, and one verifying the empty-list
case rejects the URL.
2026-04-30 02:59:50 +00:00
..
a2a_protocol feat(guardrails): LLM-as-a-Judge guardrail (#26360) 2026-04-24 17:15:32 -07:00
anthropic_interface style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
assistants
batch_completion
batches
caching fix(caching): preserve prompt_tokens_details through embedding cache round-trip (#26653) 2026-04-28 08:25:11 -07:00
completion_extras Revert "Merge pull request #24417 from Chesars/refactor/shared-format-mapping" 2026-04-25 15:03:24 -03:00
compression Prompt Compression - add it to the proxy (#25729) 2026-04-20 15:08:00 -07:00
containers style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
endpoints/speech/speech_to_completion_bridge
evals style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
experimental_mcp_client
files style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
fine_tuning
google_genai feat(proxy): LiteLLM headers on Google native generateContent routes (#25500) 2026-04-29 12:34:14 -07:00
images Feat(dashscope): add image generation support for qwen-image-2.0 and qwen-image-2.0-pro (#25672) 2026-04-22 20:03:46 -07:00
integrations feat(logging): add retry settings for generic API logger (#26645) 2026-04-28 08:38:17 -07:00
interactions style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
litellm_core_utils Add gpt-image-2 support (#26644) (#26705) 2026-04-28 20:10:42 -07:00
llms Merge pull request #26662 from BerriAI/litellm_spendLogsErrorRedaction 2026-04-29 14:26:48 -07:00
ocr style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
passthrough style: apply black formatting 2026-04-20 16:02:21 -07:00
proxy fix(mcp): close redirect bypass + empty-getaddrinfo gap on SSRF guard 2026-04-30 02:59:50 +00:00
proxy_auth
rag style: black formatting 2026-04-25 14:47:54 -07:00
realtime_api
rerank_api
responses Revert "Merge pull request #24417 from Chesars/refactor/shared-format-mapping" 2026-04-25 15:03:24 -03:00
router_strategy refactor(adaptive_router): move update_queue out of litellm.proxy 2026-04-21 18:02:44 -07:00
router_utils style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
search style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
secret_managers style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
skills style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
types feat(mcp): rehash short tool prefix on collision and cache per server 2026-04-29 03:43:34 +00:00
vector_store_files
vector_stores style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
videos style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
__init__.py Merge pull request #26303 from BerriAI/litellm_internal_staging 2026-04-23 08:30:54 +05:30
_internal_context.py
_lazy_imports_registry.py feat(bedrock): add support for bedrock-mantle endpoint (Claude Mythos Preview) (#26196) 2026-04-21 15:41:58 -07:00
_lazy_imports.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
_logging.py
_redis_credential_provider.py fix(redis): cache GCP IAM token to prevent async event loop blocking (#26441) 2026-04-25 23:13:39 -07:00
_redis.py
_service_logger.py
_uuid.py
_version.py
anthropic_beta_headers_config.json Merge pull request #25867 from BerriAI/litellm_day_0_opus_4.7_support 2026-04-16 22:49:51 +05:30
anthropic_beta_headers_manager.py
blog_posts.json
budget_manager.py
constants.py fix: added keepalive args for aiohttp tcpconnector 2026-04-29 09:14:57 -07:00
cost_calculator.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
cost.json
exceptions.py fix(proxy): invoke post-call guardrails on pass-through endpoint responses (#20270) (#26262) 2026-04-27 08:58:22 +05:30
main.py Merge pull request #24374 from BerriAI/litellm_staging_03_22_2026 2026-04-24 12:38:47 -07:00
model_prices_and_context_window_backup.json Add gpt-image-2 support (#26644) (#26705) 2026-04-28 20:10:42 -07:00
mypy.ini
policy_templates_backup.json
provider_endpoints_support_backup.json Feature/add audio support for scaleway (#26110) 2026-04-20 14:49:41 -07:00
py.typed
router.py fix(router): propagate custom cost_per_token from db model_info in fallback path (#25888) 2026-04-27 08:58:41 +05:30
scheduler.py
setup_wizard.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
timeout.py
utils.py Add gpt-image-2 support (#26644) (#26705) 2026-04-28 20:10:42 -07:00