Issue Station
Sign In
Tools hereToolbox

litellm - ✅(Solved) Fix [Bug]: user_url_validation and user_url_allowed_hosts is not taking effect after https://github.com/BerriAI/litellm/pull/25906 [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
BerriAI/litellm#26599•Fetched 2026-04-28 06:26:35
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
Jackson-MYJackson-MY
Participants
Jackson-MYJackson-MY
Timeline (top)
labeled ×1

PR fix notes

PR #25906: fix(proxy): add URL validation for user-supplied URLs

Description (problem / solution / changelog)

Relevant issues

Adds SSRF protection for user-supplied URLs across multiple endpoints.

Reopens #25837 (original base litellm_yj_apr15 was deleted); rebased onto litellm_internal_staging. No content changes.

Pre-Submission checklist

  • I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
  • My PR passes all unit tests on make test-unit
  • My PR's scope is as isolated as possible, it only solves 1 specific problem
  • I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Type

🐛 Bug Fix

Changes

1. New shared utility: litellm/litellm_core_utils/url_utils.py

  • validate_url(url) — resolves DNS, validates all IPs against private network ranges (RFC1918, link-local, loopback, IMDS, carrier-grade NAT). For HTTP URLs, rewrites the URL to the validated IP to prevent DNS rebinding. For HTTPS, relies on TLS certificate binding.
  • safe_get(client, url) / async_safe_get(client, url) — fetch with SSRF protection on every redirect hop. Each redirect target is validated before the request is made. Caps at 10 redirects.

2. Applied to user-supplied URL entry points

  • Image URL fetching (image_handling.py) — convert_url_to_base64 and async_convert_url_to_base64 now use safe_get/async_safe_get
  • Token counter (token_counter.py) — image dimension fetching uses safe_get
  • RAG ingestion (base_ingestion.py) — file URL fetching uses async_safe_get
  • MCP OpenAPI spec loading (openapi_to_mcp_generator.py) — spec URL fetching uses async_safe_get

Protection against three SSRF vectors

  • Direct private IP — blocked by IP validation
  • DNS rebinding — blocked by resolve-and-rewrite (HTTP) or TLS certificate binding (HTTPS)
  • Redirect chain to private IP — blocked by per-hop validation in safe_get

Changed files

  • litellm/__init__.py (modified, +2/-0)
  • litellm/litellm_core_utils/prompt_templates/image_handling.py (modified, +3/-2)
  • litellm/litellm_core_utils/token_counter.py (modified, +10/-7)
  • litellm/litellm_core_utils/url_utils.py (added, +257/-0)
  • litellm/llms/custom_httpx/http_handler.py (modified, +1/-0)
  • litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py (modified, +2/-3)
  • litellm/proxy/_experimental/out/404/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/_not-found/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/api-reference/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/chat/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/experimental/api-playground/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/experimental/budgets/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/experimental/caching/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/experimental/claude-code-plugins/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/experimental/old-usage/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/experimental/prompts/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/experimental/tag-management/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/guardrails/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/login/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/logs/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/mcp/oauth/callback/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/model-hub/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/model_hub/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/model_hub_table/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/models-and-endpoints/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/onboarding/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/organizations/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/playground/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/policies/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/settings/admin-settings/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/settings/logging-and-alerts/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/settings/router-settings/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/settings/ui-theme/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/teams/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/test-key/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/tools/mcp-servers/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/tools/vector-stores/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/usage/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/users/index.html (added, +1/-0)
  • litellm/proxy/_experimental/out/virtual-keys/index.html (added, +1/-0)
  • litellm/rag/ingestion/base_ingestion.py (modified, +2/-1)
  • tests/mcp_tests/test_openapi_spec_path_url.py (modified, +11/-3)
  • tests/test_litellm/litellm_core_utils/test_image_handling.py (modified, +27/-12)
  • tests/test_litellm/litellm_core_utils/test_url_utils.py (added, +396/-0)
RAW_BUFFERClick to expand / collapse

Check for existing issues

  • I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

user_url_validation and user_url_allowed_hosts is not taking effect after https://github.com/BerriAI/litellm/pull/25906

Steps to Reproduce

  1. Config the configs in the generatl_settings general_settings: user_url_validation: False user_url_allowed_hosts:
    • 10.80.1.20

Relevant log output

What part of LiteLLM is this about?

MCP Open API spec

<img width="1449" height="410" alt="Image" src="https://github.com/user-attachments/assets/acdbcff0-937b-49d1-94f0-446a9c5074e9" />

What LiteLLM version are you on ?

v1.83.14

Twitter / LinkedIn details

No response

extent analysis

TL;DR

The issue may be resolved by re-examining the configuration of user_url_validation and user_url_allowed_hosts in the general_settings after the changes introduced in pull request #25906.

Guidance

  • Review the changes made in pull request #25906 to understand how they might affect the user_url_validation and user_url_allowed_hosts settings.
  • Verify that the general_settings configuration is being loaded correctly and that the values for user_url_validation and user_url_allowed_hosts are being applied as expected.
  • Check the documentation for the MCP Open API spec to ensure that the configuration settings are being used correctly in the context of the LiteLLM version being used (v1.83.14).
  • Test the configuration with different settings to isolate the issue and determine if it's specific to certain values or combinations of values.

Notes

The issue seems to be related to changes introduced in a specific pull request, so understanding those changes is crucial to resolving the issue. Without more information about the changes or the expected behavior, it's difficult to provide a more specific solution.

Recommendation

Apply workaround: Revert or modify the changes introduced in pull request #25906 to ensure compatibility with the current configuration settings, as the issue seems to be related to those changes.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ssr#tool integration#LLM response#prompt template

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING