(Security) - Prevent potential provider key exposure through URL-valued model destinations and fallbacks

[yucheng-berri]

Security impact

This closes several related critical SSRF and credential-exfiltration bypasses in request-parameter and provider-destination handling. The URL-valued destination guard on model/file_id only checked whether the raw value began with http, so a provider prefix (huggingface/https://attacker) or a comma-batched entry slipped past it; downstream the prefix was stripped and the HuggingFace and Oobabooga handlers used the remaining URL as the outbound destination with the proxy's provider key attached, leaking that key to the attacker. Banned request-body params could also be smuggled through nested fallbacks entries, and the blocklist missed the vertex_ai_credentials alias. The fix strips prefixes and splits batches before the guard runs, tightens the handler URL checks, applies the banned-param and URL checks recursively across all fallback fields with a fail-closed depth cap, and extends the blocklist.

Severity: Critical. Authenticated low-privilege attacker; provider-credential theft and internal SSRF through multiple request shapes

Relevant issues

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

Type

🧹 Refactoring

Changes

Tidies up how the proxy validates request-body parameters and how a couple of provider handlers select their outbound destination

The destination lookup for model and file_id now compares provider-prefixed and comma-separated values consistently, and the HuggingFace and Oobabooga handlers pick their destination with an explicit scheme-prefix check rather than a substring match. The request-body parameter checks are applied consistently across nested fallbacks, context_window_fallbacks, and content_policy_fallbacks on both the request root and router_settings_override, with a bounded traversal depth, and the same traversal is reused for the fallback model resolution path. The destination-candidate helper moves into litellm_core_utils/url_utils so the proxy and the request path share one implementation, and one additional provider credential alias is folded into the existing request-body parameter list for consistency

QA runbook

Unit coverage lives in tests/test_litellm/proxy/auth/test_auth_utils.py, tests/test_litellm/proxy/auth/test_router_override_fallback_auth.py, and tests/test_litellm/proxy/test_provider_url_destination_guard.py, along with the HuggingFace and Oobabooga handler tests; all pass locally

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[yucheng-berri]

@greptileai

[greptile-apps]

Greptile Summary

This PR strengthens request validation and provider destination handling. The main changes are:

• Shared traversal for nested fallback settings
• Fail-closed validation for excessive fallback depth
• URL checks for prefixed and comma-separated destinations
• Explicit scheme checks in HuggingFace and Oobabooga handlers
• Tests for nested fallbacks and destination selection

Confidence Score: 5/5

This looks safe to merge.

• Excessive fallback nesting now fails closed.
• String and dictionary fallback destinations use the same URL checks.
• Tests cover the reported failure paths and related nested forms.
• No blocking issue was found in the updated code.

Important Files Changed

Filename	Overview
litellm/litellm_core_utils/url_utils.py	Adds shared parsing for plain, provider-prefixed, and comma-separated destination candidates.
litellm/proxy/auth/auth_utils.py	Adds bounded fallback traversal and validates banned parameters and URL destinations for each target.
litellm/proxy/auth/user_api_key_auth.py	Reuses shared fallback traversal when enforcing model access.
litellm/proxy/litellm_pre_call_utils.py	Applies destination validation to every candidate extracted from model and file identifiers.
litellm/llms/huggingface/embedding/handler.py	Uses an explicit HTTP scheme prefix when selecting the embedding destination.
litellm/llms/oobabooga/chat/oobabooga.py	Uses explicit HTTP scheme prefixes for completion and embedding destinations.
tests/test_litellm/proxy/auth/test_auth_utils.py	Covers nested fallback validation, depth rejection, URL targets, and the added credential alias.
tests/test_litellm/proxy/auth/test_router_override_fallback_auth.py	Covers fallback model authorization across request surfaces and nested fallback shapes.
tests/test_litellm/proxy/test_provider_url_destination_guard.py	Covers prefixed, comma-separated, uppercase, allowlisted, and ordinary destination values.

_{Reviews (7): Last reviewed commit: "chore(proxy): clean up request parameter..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR hardens proxy request validation and provider endpoint selection. The main changes are:

• Validates normalized URL candidates from provider-prefixed and batched request values
• Applies one bounded traversal to nested fallback safety and model-access checks
• Blocks an additional credential parameter alias
• Uses exact URL prefixes in the HuggingFace and Oobabooga handlers
• Adds focused tests for the updated request paths

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_utils.py	Adds bounded fallback traversal and checks fallback target dictionaries for protected request parameters.
litellm/proxy/auth/user_api_key_auth.py	Reuses the shared traversal to authorize every extracted fallback model.
litellm/proxy/litellm_pre_call_utils.py	Checks normalized provider-prefixed and comma-separated URL destination candidates.
litellm/llms/huggingface/embedding/handler.py	Limits direct model URL handling to explicit HTTP and HTTPS prefixes.
litellm/llms/huggingface/embedding/transformation.py	Removes redundant embedding endpoint selection logic.
litellm/llms/oobabooga/chat/oobabooga.py	Uses exact URL prefix checks for completion and embedding endpoints.
tests/test_litellm/proxy/auth/test_auth_utils.py	Adds tests for nested fallback validation, credential aliases, traversal limits, and caller credentials.
tests/test_litellm/proxy/auth/test_router_override_fallback_auth.py	Covers supported fallback shapes and nested model authorization.
tests/test_litellm/proxy/test_provider_url_destination_guard.py	Covers prefixed, batched, case-varied, ordinary, and allowlisted destination values.

_{Reviews (2): Last reviewed commit: "fix(proxy): harden request parameter val..." | Re-trigger Greptile}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[codecov]

Codecov Report

❌ Patch coverage is 96.87500% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/llms/oobabooga/chat/oobabooga.py	50.00%	1 Missing ⚠️
litellm/proxy/auth/auth_utils.py	97.77%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[yucheng-berri]

@greptileai please review the current head e93dae5

[yucheng-berri]

@greptileai please review the current head 506dd68

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

[yucheng-berri]

@greptileai please review the current head 71be735

[yucheng-berri]

@greptileai please review the current head fa355ae

[yucheng-berri]

@greptileai please review the current head 5818eb2

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_proxy_request_param_cleanup (5818eb2) with litellm_internal_staging (2b2ae4c)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (e967bc8) during the generation of this report, so 2b2ae4c was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩