Sameer Kankute 8112fbf274 fix(proxy): sanitize user_id input and block dangerous env var keys ...

Add input validation to get_user_id_from_request (length limit, control char rejection) and a blocklist of dangerous environment variable keys in _load_environment_variables to prevent PATH/LD_PRELOAD/PYTHONPATH override via config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-27 20:38:36 +05:30

..

_experimental/mcp_server

Ishaan - March 18th changes (#24056)

2026-03-19 10:20:35 -07:00

agent_endpoints

fix(tests): restore litellm_params=None on mock agent in a2a invoke test (#23125)

2026-03-09 07:16:02 -07:00

anthropic_endpoints

Litellm ishaan march 20 (#24303)

2026-03-21 12:40:11 -07:00

auth

Merge branch 'main' into litellm_dev_sameer_16_march_week

2026-03-21 14:30:57 -07:00

client

…

common_utils

Merge pull request #20688 from BerriAI/litellm_budget_tier_enforcement_for_keys

2026-03-06 20:44:58 -08:00

db

address greptile review: async sleep, SIGKILL Windows guard, trailing newlines

2026-03-19 20:03:07 +01:00

discovery_endpoints

feat: add control plane for multi-proxy worker management

2026-03-19 22:50:19 -07:00

experimental/mcp_server

…

google_endpoints

fix: Metadata / Trace ID Missing in S3 Streaming Callbacks

2026-02-25 14:16:42 +05:30

guardrails

fix(test): add request_data param to test mock + black formatting

2026-03-23 15:43:05 +01:00

health_endpoints

Prisma DB Failure Detection and Self-Healing (#21059)

2026-03-05 13:44:49 -08:00

hooks

Merge branch 'main' into litellm_langfuse-session-trace-fix

2026-03-15 01:09:49 +05:30

image_endpoints

fixing core proxy tests

2026-02-12 17:54:32 -08:00

management_endpoints

fix(proxy): sanitize user_id input and block dangerous env var keys

2026-03-27 20:38:36 +05:30

management_helpers

Merge branch 'main' into litellm_audit_log_s3_export

2026-03-20 16:39:54 -07:00

middleware

feat: add in_flight_requests metric to /health/backlog + prometheus (#22319)

2026-02-27 18:00:50 -08:00

openai_files_endpoint

CircleCI test stability (#23055)

2026-03-07 15:19:39 -08:00

pass_through_endpoints

fix: stabilize 5 CI test failures

2026-03-13 01:03:35 +00:00

policy_engine

Guardrail Policy Versioning (#21862)

2026-02-21 20:14:31 -08:00

prompts

fix(prompts): fix prompt info lookup and delete using correct IDs (#19358)

2026-01-20 12:28:34 -08:00

public_endpoints

[Feature] Add /public/endpoints endpoint for provider endpoint support

2026-02-26 18:17:37 -08:00

rag_endpoints

tests and route permissions (#21508)

2026-02-18 16:58:38 -08:00

realtime_endpoints

fix(tests): fix flaky realtime WebRTC endpoint tests

2026-03-12 23:14:51 -07:00

response_api_endpoints

…

spend_tracking

fix(test): add user_api_key_project_alias to spend logs expected keys

2026-03-23 18:12:50 -07:00

test_configs

…

ui_crud_endpoints

Update tests/test_litellm/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py

2026-03-14 15:42:17 -07:00

vector_store_endpoints

test_delete_vector_store_checks_access

2026-01-31 12:05:09 -08:00

__init__.py

…

conftest.py

Add health endpoint tests to CI with database and Redis support (#17877)

2025-12-12 07:35:50 -08:00

test_aiohttp_cleanup_closed.py

fix(aiohttp): only set enable_cleanup_closed when required (#21897)

2026-02-23 21:06:29 -08:00

test_aiohttp_session_recovery.py

fix: use AsyncMock for concurrent test consistency

2026-03-18 00:54:23 +00:00

test_api_key_masking_in_errors.py

fix: mask API keys in error responses for invalid/malformed keys (#20289)

2026-02-12 19:58:05 +05:30

test_audio_speech_prometheus_hooks.py

fix req changes

2026-02-28 21:32:57 +05:30

test_batch_expiry.py

fix(proxy): improve team expiry enforcement validation

2026-03-03 17:29:39 -08:00

test_batch_metadata_none_fix.py

…

test_caching_routes.py

…

test_chat_completion_metadata.py

fix: propagate JWT auth metadata to OTEL spans (#19627)

2026-01-23 21:21:23 -08:00

test_common_request_processing.py

[Fix] Malformed messages returning 500 instead of 400

2026-03-12 23:01:25 -07:00

test_custom_proxy.py

…

test_empty_model_list.py

[Release Fix] (#22411)

2026-02-28 09:46:35 -08:00

test_enforce_user_param.py

…

test_fallback_management_endpoints.py

Add fallback endpoints support

2026-01-16 10:51:33 +05:30

test_fastapi_offline_routes.py

…

test_health_check_functions.py

Fix_mapped tests part 2

2026-02-26 12:43:39 +05:30

test_health_check_max_tokens.py

add docs and formatting

2026-02-28 14:08:09 +05:30

test_litellm_pre_call_utils.py

Bug Fix: auto-inject prompt caching support for Gemini models (#21881)

2026-03-03 20:25:35 -08:00

test_max_budget_env_var.py

Fix PR review issues: gpt-4-0314 prompt caching, case-insensitive data URL check, test I/O mocking

2026-03-21 11:30:29 -07:00

test_model_dump_with_preserved_fields.py

Fix_mapped tests part 2

2026-02-26 12:43:39 +05:30

test_model_id_header_propagation.py

…

test_model_info_default_limits.py

refactor: consolidate duplicate helpers and eliminate success-handler double lookup

2026-03-19 07:26:43 -04:00

test_model_level_guardrails.py

test: use __file__-relative sys.path for stable test imports

2026-03-16 21:07:07 +01:00

test_openapi_schema_validation.py

Reapply "feat: add model_cost aliases expansion support"

2026-03-12 13:36:57 -03:00

test_prometheus_cleanup.py

[Infra] Merging RC Branch with Main (#23786)

2026-03-16 15:32:20 -07:00

test_proxy_cli.py

feat(proxy): use AZURE_DEFAULT_API_VERSION for proxy --api_version default

2026-03-19 15:57:03 +05:30

test_proxy_server.py

fix(proxy): sanitize user_id input and block dangerous env var keys

2026-03-27 20:38:36 +05:30

test_proxy_types.py

fix: Add PROXY_ADMIN role to system user for key rotation (#21896)

2026-02-27 19:11:29 -08:00

test_proxy_utils.py

[Feat[ extends OAuth2 M2M authentication support to info routes (/key/info, /team/info, /user/info, /model/info) (#22713)

2026-03-06 17:29:25 -08:00

test_pyroscope.py

Fix CI/CD pyroscope test failure (#21219)

2026-02-14 12:07:20 -08:00

test_response_model_sanitization.py

feat(azure_ai): show actual model used in Azure Model Router response

2026-03-12 11:41:19 +05:30

test_route_a2a_models.py

Fix test_route_a2a_model_bypasses_router

2026-02-05 09:47:05 +05:30

test_route_llm_request.py

Override router settings

2026-01-31 16:04:52 -08:00

test_shared_health_check.py

Fix_mapped tests part 2

2026-02-26 12:43:39 +05:30

test_spend_log_cleanup.py

Fix spend log cleanup: lock tracking, integer retention, skip log level

2026-03-03 10:12:08 -08:00

test_swagger_chat_completions.py

[Release Fix] (#22411)

2026-02-28 09:46:35 -08:00

test_team_member_update.py

…

test_tools_allowlist_enforcement.py

Bug Fix: auto-inject prompt caching support for Gemini models (#21881)

2026-03-03 20:25:35 -08:00

test_update_llm_router_resilience.py

fix(proxy): isolate get_config failures from model loading in sync loop

2026-02-26 17:49:44 -03:00