Fix: malformed tool call transformation in bedrock - #19198
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| f"Malformed JSON in tool call arguments for tool '{name}': {str(e)}. " | ||
| f"Storing as raw string to allow conversation to continue." |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
At a high level, the fix is to ensure that any logging or error/exception messages do not contain secret material: API keys, passwords, cloud credentials, or raw tool arguments. Instead, logs should contain only high‑level context (e.g., which tool failed, the model name, or that a key was missing) and, if necessary, redacted/masked versions of sensitive values. Also, helper structures like litellm_params that purposely store secrets for runtime behavior should not be blindly stringified or logged.
For the concrete sink in litellm/litellm_core_utils/prompt_templates/factory.py, we can safely change the log message so that it no longer interpolates potentially tainted data. The current warning logs the tool function name and exception detail:
verbose_logger.warning(
f"Malformed JSON in tool call arguments for tool '{name}': {str(e)}. "
f"Storing as raw string to allow conversation to continue."
)To avoid leaking any part of the untrusted path (and still be useful for debugging), we can:
- Log a generic message that does not include the tool name or parsed content.
- Optionally include the exception type or a generic error tag, which is not secret.
This change preserves functionality (we still detect parsing errors, fall back to raw string arguments, and log that behavior) while eliminating the possibility of logging secret values coming from tool names/arguments.
No other files need explicit edits for this particular fix because the only explicit sink shown is in factory.py, and we are not allowed to alter external logging behavior in the snippets we haven’t seen. The various get_* and _get_openai_compatible_provider_info functions only construct values and don’t themselves log secrets in the displayed code.
Concretely:
- In
litellm/litellm_core_utils/prompt_templates/factory.py, in_convert_to_bedrock_tool_call_invoke, replace theverbose_logger.warningstring with a generic message that omits{name}andstr(e)details that come from tainted data. - No imports, method signatures, or call sites need to change.
| @@ -3239,10 +3239,12 @@ | ||
| # Try to parse the arguments JSON | ||
| try: | ||
| arguments_input = json.loads(arguments) | ||
| except json.JSONDecodeError as e: | ||
| except json.JSONDecodeError: | ||
| # Log a generic message without including tool arguments or names, | ||
| # to avoid leaking potentially sensitive data. | ||
| verbose_logger.warning( | ||
| f"Malformed JSON in tool call arguments for tool '{name}': {str(e)}. " | ||
| f"Storing as raw string to allow conversation to continue." | ||
| "Malformed JSON in tool call arguments. " | ||
| "Storing original arguments string to allow conversation to continue." | ||
| ) | ||
| arguments_input = arguments | ||
|
|
merge main in malformed tool call PR
…d_tool_bedrock Fix: malformed tool call transformation in bedrock
2 participants
Relevant issues
Fixes #18667
Pre-Submission checklist
Please complete all items before asking a LiteLLM maintainer to review your PR
tests/litellm/directory, Adding at least 1 test is a hard requirement - see detailsmake test-unitCI (LiteLLM team)
Branch creation CI run
Link:
CI run for the last commit
Link:
Merge / cherry-pick CI run
Links:
Type
🐛 Bug Fix
Changes