fix(proxy): add URL validation for user-supplied URLs - #25906

Merged

yuneng-berri merged 15 commits into

BerriAI:litellm_yj_apr17from

stuxf:fix/ssrf-url-validation

Apr 17, 2026

Commits on Apr 16, 2026

fix(proxy): add SSRF protection via resolve-and-rewrite for user-supplied URLs
stuxf
committed
9363f36
fix(proxy): add safe_get/async_safe_get with redirect validation
stuxf
committed
d15196b
fix: preserve caller headers across redirect hops in safe_get
stuxf
committed
037fb57
fix: skip DNS resolution for base64 data in token counter, add unit tests
stuxf
committed
b94aaa7
test: mock SSRF validation in openapi spec URL test
stuxf
committed
62ec396
fix: fail-closed on unparseable IPs, rewrite HTTPS when SSL verify disabled
stuxf
committed
814d03d
fix: redirect loop was dead code, clean up imports
stuxf
committed
e2a0c96
fix: sync redirect bypass, Host header port, redirect loop dead code
stuxf
committed
00b25d6
refactor: move url_utils to litellm_core_utils to avoid proxy dependency
stuxf
committed
1ba2be7
test: bypass SSRF validation in image handling tests
stuxf
committed
30c6556
chore: remove unused asyncio import
stuxf
committed
f5a9218
test: mock DNS resolution, hoist httpx import to module level
stuxf
committed
1f50c6f
feat: add admin opt-out for user URL validation
stuxf
committed
1d3dda9
fix: switch blocklist to RFC 6890 via ipaddress.is_global, block multicast and Azure Wire Server
stuxf
committed
0602564
style: use 'is not None' for port check (handle port 0 explicitly)
stuxf
committed
aa2f05f