From 051d49f2fbd239ea78113613b99ac95db2a342a7 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 22 Apr 2026 12:38:25 -0700 Subject: [PATCH 1/6] fix: extend request body parameter restrictions to cloud provider auth fields --- litellm/proxy/auth/auth_utils.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/auth/auth_utils.py b/litellm/proxy/auth/auth_utils.py index 18aea48e96..448c975d12 100644 --- a/litellm/proxy/auth/auth_utils.py +++ b/litellm/proxy/auth/auth_utils.py @@ -151,7 +151,15 @@ def is_request_body_safe( A malicious user can set the api_base to their own domain and invoke POST /chat/completions to intercept and steal the OpenAI API key. Relevant issue: https://huntr.com/bounties/4001e1a2-7b7a-4776-a3ae-e6692ec3d997 """ - banned_params = ["api_base", "base_url", "user_config"] + banned_params = [ + "api_base", + "base_url", + "user_config", + "aws_sts_endpoint", + "aws_web_identity_token", + "aws_role_name", + "vertex_credentials", + ] for param in banned_params: if ( From 699b820c22d03fb2180165fa276d0eb5b74e5194 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 22 Apr 2026 13:45:18 -0700 Subject: [PATCH 2/6] fix: align image URL fetch with validated client in bedrock and token counter paths --- litellm/litellm_core_utils/prompt_templates/factory.py | 7 ++++--- litellm/litellm_core_utils/token_counter.py | 7 +++++++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/litellm/litellm_core_utils/prompt_templates/factory.py b/litellm/litellm_core_utils/prompt_templates/factory.py index bf950357ba..5a19c224aa 100644 --- a/litellm/litellm_core_utils/prompt_templates/factory.py +++ b/litellm/litellm_core_utils/prompt_templates/factory.py @@ -15,6 +15,7 @@ import litellm.types import litellm.types.llms from litellm import verbose_logger from litellm._uuid import uuid +from litellm.litellm_core_utils.url_utils import async_safe_get, safe_get from litellm.llms.custom_httpx.http_handler import HTTPHandler, get_async_httpx_client from litellm.types.files import get_file_extension_from_mime_type from litellm.types.llms.anthropic import * @@ -3324,7 +3325,7 @@ def _load_image_from_url(image_url): try: # Send a GET request to the image URL client = HTTPHandler(concurrent_limit=1) - response = client.get(image_url) + response = safe_get(client, image_url) response.raise_for_status() # Raise an exception for HTTP errors # Check the response's content type to ensure it is an image @@ -3562,7 +3563,7 @@ class BedrockImageProcessor: params={"concurrent_limit": 1}, ) # Send a GET request to the image URL - response = await client.get(image_url, follow_redirects=True) + response = await async_safe_get(client, image_url) response.raise_for_status() # Raise an exception for HTTP errors return BedrockImageProcessor._post_call_image_processing( @@ -3577,7 +3578,7 @@ class BedrockImageProcessor: try: client = HTTPHandler(concurrent_limit=1) # Send a GET request to the image URL - response = client.get(image_url, follow_redirects=True) + response = safe_get(client, image_url) response.raise_for_status() # Raise an exception for HTTP errors return BedrockImageProcessor._post_call_image_processing( diff --git a/litellm/litellm_core_utils/token_counter.py b/litellm/litellm_core_utils/token_counter.py index 01e5dc39a3..d893b98078 100644 --- a/litellm/litellm_core_utils/token_counter.py +++ b/litellm/litellm_core_utils/token_counter.py @@ -23,6 +23,7 @@ from litellm.constants import ( DEFAULT_IMAGE_HEIGHT, DEFAULT_IMAGE_TOKEN_COUNT, DEFAULT_IMAGE_WIDTH, + MAX_IMAGE_URL_DOWNLOAD_SIZE_MB, MAX_LONG_SIDE_FOR_IMAGE_HIGH_RES, MAX_SHORT_SIDE_FOR_IMAGE_HIGH_RES, MAX_TILE_HEIGHT, @@ -215,7 +216,13 @@ def get_image_dimensions( try: client = _get_httpx_client() response = safe_get(client, data) + max_bytes = int(MAX_IMAGE_URL_DOWNLOAD_SIZE_MB * 1024 * 1024) + content_length = response.headers.get("Content-Length") + if content_length is not None and int(content_length) > max_bytes: + raise ValueError("Image response exceeds size limit") img_data = response.read() + if len(img_data) > max_bytes: + raise ValueError("Image response exceeds size limit") except Exception: pass if img_data is None: From df93941cd7124bf20ed5a4e2493abb0f9f799c39 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 22 Apr 2026 16:28:51 -0700 Subject: [PATCH 3/6] fix: enforce format constraints on provider-specific URL parameters Brings the Snowflake, S3 Vectors, Vertex AI, and Bedrock URL construction paths in line with the existing pattern of validating interpolated values before use. --- litellm/llms/bedrock/batches/transformation.py | 4 +++- litellm/llms/s3_vectors/vector_stores/transformation.py | 3 +++ litellm/llms/snowflake/utils.py | 3 +++ litellm/llms/vertex_ai/common_utils.py | 7 +++++-- .../pass_through_endpoints/llm_passthrough_endpoints.py | 5 +++++ 5 files changed, 19 insertions(+), 3 deletions(-) diff --git a/litellm/llms/bedrock/batches/transformation.py b/litellm/llms/bedrock/batches/transformation.py index 5d008038ca..0602b1c2f6 100644 --- a/litellm/llms/bedrock/batches/transformation.py +++ b/litellm/llms/bedrock/batches/transformation.py @@ -1,4 +1,5 @@ import os +import re import time from typing import Any, Dict, List, Literal, Optional, Union, cast @@ -294,7 +295,8 @@ class BedrockBatchesConfig(BaseAWSLLM, BaseBatchesConfig): raise ValueError(f"Invalid ARN format: {batch_id}") region = arn_parts[3] - # arn_parts[5] contains "model-invocation-job/{jobId}" + if not re.match(r"^[a-z][a-z0-9-]*$", region): + raise ValueError(f"Invalid region in ARN: {batch_id}") # Build the endpoint URL for GetModelInvocationJob # AWS API format: GET /model-invocation-job/{jobIdentifier} diff --git a/litellm/llms/s3_vectors/vector_stores/transformation.py b/litellm/llms/s3_vectors/vector_stores/transformation.py index 11836e361e..19b5976986 100644 --- a/litellm/llms/s3_vectors/vector_stores/transformation.py +++ b/litellm/llms/s3_vectors/vector_stores/transformation.py @@ -1,3 +1,4 @@ +import re from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union import httpx @@ -66,6 +67,8 @@ class S3VectorsVectorStoreConfig(BaseVectorStoreConfig, BaseAWSLLM): aws_region_name = litellm_params.get("aws_region_name") if not aws_region_name: raise ValueError("aws_region_name is required for S3 Vectors") + if not re.match(r"^[a-z][a-z0-9-]*$", aws_region_name): + raise ValueError("Invalid aws_region_name format") return f"https://s3vectors.{aws_region_name}.api.aws" def transform_search_vector_store_request( diff --git a/litellm/llms/snowflake/utils.py b/litellm/llms/snowflake/utils.py index 9d458f6ece..d84efdd9fc 100644 --- a/litellm/llms/snowflake/utils.py +++ b/litellm/llms/snowflake/utils.py @@ -1,3 +1,4 @@ +import re from typing import TYPE_CHECKING, Any, List, Optional, Tuple from litellm.secret_managers.main import get_secret_str @@ -61,6 +62,8 @@ class SnowflakeBaseConfig: account_id = get_secret_str("SNOWFLAKE_ACCOUNT_ID") if account_id is None: raise ValueError("Missing snowflake account_id") + if not re.match(r"^[a-zA-Z0-9_-]+$", account_id): + raise ValueError("Invalid account_id format") api_base = f"https://{account_id}.snowflakecomputing.com/api/v2" api_base = api_base.rstrip("/") diff --git a/litellm/llms/vertex_ai/common_utils.py b/litellm/llms/vertex_ai/common_utils.py index 43e77f4fb7..c13f6a86f8 100644 --- a/litellm/llms/vertex_ai/common_utils.py +++ b/litellm/llms/vertex_ai/common_utils.py @@ -232,8 +232,11 @@ def get_vertex_base_url( """ if vertex_location == "global": return "https://aiplatform.googleapis.com" - else: - return f"https://{vertex_location}-aiplatform.googleapis.com" + if vertex_location is not None and not re.match( + r"^[a-z][a-z0-9-]*$", vertex_location + ): + raise ValueError("Invalid vertex_location format") + return f"https://{vertex_location}-aiplatform.googleapis.com" def _get_embedding_url( diff --git a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py index 1ef866486e..3cf155739c 100644 --- a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py +++ b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py @@ -8,6 +8,7 @@ Use litellm with Anthropic SDK, Vertex AI SDK, Cohere SDK, etc. import json import os +import re from typing import Any, Optional, Tuple, Union, cast import httpx @@ -1500,6 +1501,10 @@ def get_vertex_base_url(vertex_location: Optional[str]) -> str: """ if vertex_location == "global": return "https://aiplatform.googleapis.com/" + if vertex_location is not None and not re.match( + r"^[a-z][a-z0-9-]*$", vertex_location + ): + raise ValueError("Invalid vertex_location format") return f"https://{vertex_location}-aiplatform.googleapis.com/" From 375bf4d7d67a6f9a1ead0512e90d68c05b12219f Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 22 Apr 2026 18:04:39 -0700 Subject: [PATCH 4/6] fix: tighten file input handling in image edit endpoints Bring string input handling for image/mask parameters in line with the multipart-only contract expected by the image edit endpoint. --- .../image_edit/transformation.py | 12 +++++++----- .../image_edit/vertex_imagen_transformation.py | 17 ++++++++++------- litellm/proxy/image_endpoints/endpoints.py | 7 +++++++ 3 files changed, 24 insertions(+), 12 deletions(-) diff --git a/litellm/llms/black_forest_labs/image_edit/transformation.py b/litellm/llms/black_forest_labs/image_edit/transformation.py index c6d8e8298e..d05a802d23 100644 --- a/litellm/llms/black_forest_labs/image_edit/transformation.py +++ b/litellm/llms/black_forest_labs/image_edit/transformation.py @@ -14,7 +14,9 @@ from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union import httpx from httpx._types import RequestFiles +import litellm from litellm.constants import DEFAULT_MAX_RECURSE_DEPTH +from litellm.litellm_core_utils.url_utils import safe_get from litellm.llms.base_llm.image_edit.transformation import BaseImageEditConfig from litellm.secret_managers.main import get_secret_str from litellm.types.images.main import ImageEditOptionalRequestParams @@ -206,14 +208,14 @@ class BlackForestLabsImageEditConfig(BaseImageEditConfig): ) elif isinstance(image, str): if image.startswith(("http://", "https://")): - # Download image from URL - response = httpx.get(image, timeout=60.0) + response = safe_get(litellm.module_level_client, image, timeout=60.0) response.raise_for_status() return response.content else: - # Assume it's a file path - with open(image, "rb") as f: - return f.read() + raise ValueError( + f"Unsupported image input: plain string values that are not URLs are not accepted. " + "Provide image bytes or a file-like object." + ) elif hasattr(image, "read"): # File-like object pos = getattr(image, "tell", lambda: 0)() diff --git a/litellm/llms/vertex_ai/image_edit/vertex_imagen_transformation.py b/litellm/llms/vertex_ai/image_edit/vertex_imagen_transformation.py index 7979e0e790..e35b340f0c 100644 --- a/litellm/llms/vertex_ai/image_edit/vertex_imagen_transformation.py +++ b/litellm/llms/vertex_ai/image_edit/vertex_imagen_transformation.py @@ -348,13 +348,16 @@ class VertexAIImagenImageEditConfig(BaseImageEditConfig, VertexLLM): if stream_pos is not None: image.seek(stream_pos) return data - if isinstance(image, (str, Path)): - path_obj = Path(image) - if not path_obj.exists(): - raise ValueError( - f"Mask/image path does not exist for Vertex AI Imagen image edit: {path_obj}" - ) - return path_obj.read_bytes() + if isinstance(image, str): + raise ValueError( + "Unsupported image input: plain string values are not accepted for " + "Vertex AI Imagen image edit. Provide image bytes or a file-like object." + ) + if isinstance(image, Path): + raise ValueError( + "Unsupported image input: filesystem paths are not accepted for " + "Vertex AI Imagen image edit. Provide image bytes or a file-like object." + ) if hasattr(image, "read"): data = image.read() if isinstance(data, str): diff --git a/litellm/proxy/image_endpoints/endpoints.py b/litellm/proxy/image_endpoints/endpoints.py index 4f994b87f5..fe8b7c6fdc 100644 --- a/litellm/proxy/image_endpoints/endpoints.py +++ b/litellm/proxy/image_endpoints/endpoints.py @@ -285,6 +285,13 @@ async def image_edit_api( if mask_files: data["mask"] = mask_files + for _field in ("image", "mask"): + if _field in data and isinstance(data[_field], str): + raise HTTPException( + status_code=422, + detail=f"'{_field}' must be provided as a multipart file upload, not a string.", + ) + # Ensure prompt exists in data (default to None for models that don't require it) if "prompt" not in data: data["prompt"] = None From 42342d35fd13814f5a2add22cfe0ebb91589f227 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 22 Apr 2026 18:08:17 -0700 Subject: [PATCH 5/6] fix: remove extraneous f-prefix in ValueError message --- litellm/llms/black_forest_labs/image_edit/transformation.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/litellm/llms/black_forest_labs/image_edit/transformation.py b/litellm/llms/black_forest_labs/image_edit/transformation.py index d05a802d23..eb48b0be80 100644 --- a/litellm/llms/black_forest_labs/image_edit/transformation.py +++ b/litellm/llms/black_forest_labs/image_edit/transformation.py @@ -213,7 +213,7 @@ class BlackForestLabsImageEditConfig(BaseImageEditConfig): return response.content else: raise ValueError( - f"Unsupported image input: plain string values that are not URLs are not accepted. " + "Unsupported image input: plain string values that are not URLs are not accepted. " "Provide image bytes or a file-like object." ) elif hasattr(image, "read"): From 994e35135dc53badf26455e12d04d87981bc3561 Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Thu, 23 Apr 2026 11:20:20 -0700 Subject: [PATCH 6/6] fix: correct image size limit enforcement and vertex_location None passthrough MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit token_counter.py: the previous size-limit raises were inside except Exception: pass, so they were silently swallowed. The post-read raise was worse — img_data was already assigned the full body before the raise, so the oversized value was used downstream. Restructured to only assign img_data when the body is within bounds. vertex_ai/common_utils.py and llm_passthrough_endpoints.py: the is-not-None guard skipped validation for None, falling through to produce "https://None-aiplatform..." Added explicit None check that raises before the regex guard. --- litellm/litellm_core_utils/token_counter.py | 9 +++++---- litellm/llms/vertex_ai/common_utils.py | 6 +++--- .../pass_through_endpoints/llm_passthrough_endpoints.py | 6 +++--- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/litellm/litellm_core_utils/token_counter.py b/litellm/litellm_core_utils/token_counter.py index d893b98078..e6a68de07e 100644 --- a/litellm/litellm_core_utils/token_counter.py +++ b/litellm/litellm_core_utils/token_counter.py @@ -219,10 +219,11 @@ def get_image_dimensions( max_bytes = int(MAX_IMAGE_URL_DOWNLOAD_SIZE_MB * 1024 * 1024) content_length = response.headers.get("Content-Length") if content_length is not None and int(content_length) > max_bytes: - raise ValueError("Image response exceeds size limit") - img_data = response.read() - if len(img_data) > max_bytes: - raise ValueError("Image response exceeds size limit") + pass # skip download; img_data stays None + else: + body = response.read() + if len(body) <= max_bytes: + img_data = body except Exception: pass if img_data is None: diff --git a/litellm/llms/vertex_ai/common_utils.py b/litellm/llms/vertex_ai/common_utils.py index c13f6a86f8..fb8fd90340 100644 --- a/litellm/llms/vertex_ai/common_utils.py +++ b/litellm/llms/vertex_ai/common_utils.py @@ -232,9 +232,9 @@ def get_vertex_base_url( """ if vertex_location == "global": return "https://aiplatform.googleapis.com" - if vertex_location is not None and not re.match( - r"^[a-z][a-z0-9-]*$", vertex_location - ): + if vertex_location is None: + raise ValueError("vertex_location is required") + if not re.match(r"^[a-z][a-z0-9-]*$", vertex_location): raise ValueError("Invalid vertex_location format") return f"https://{vertex_location}-aiplatform.googleapis.com" diff --git a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py index 3cf155739c..8a86b98fee 100644 --- a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py +++ b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py @@ -1501,9 +1501,9 @@ def get_vertex_base_url(vertex_location: Optional[str]) -> str: """ if vertex_location == "global": return "https://aiplatform.googleapis.com/" - if vertex_location is not None and not re.match( - r"^[a-z][a-z0-9-]*$", vertex_location - ): + if vertex_location is None: + raise ValueError("vertex_location is required") + if not re.match(r"^[a-z][a-z0-9-]*$", vertex_location): raise ValueError("Invalid vertex_location format") return f"https://{vertex_location}-aiplatform.googleapis.com/"