bedrock api response null type handling

[ishaan-berri]

Closes #24147 — resolving merge conflicts from the original PR.

Changes

• bedrock_guardrails.py: null-safety fixes for or [] fallback on list fields (regexes, piiEntities, topics, filters, customWords, managedWordLists) that Bedrock can return as explicit None
• New test classes: TestRedactPiiMatchesNullSafety, TestShouldRaiseGuardrailBlockedExceptionNullSafety, TestApplyGuardrailNullSafety
• L3 regression tests for _extract_blocked_assessments and _get_http_exception_for_blocked_guardrail

Pre-Submission Checklist

• Tests added
• make test-unit passes locally

Type

• Bug Fix

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ kothamah
❌ ishaan-berri
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 15, 2026 7:36pm

[greptile-apps]

Greptile Summary

This PR fixes a TypeError: 'NoneType' object is not iterable crash triggered when the Bedrock ApplyGuardrail API returns explicit JSON null for list fields (piiEntities, regexes, topics, filters, customWords, managedWordLists) — a case that dict.get("key", []) does not protect against. The fix consistently replaces that pattern with .get("key") or [] in _redact_pii_matches, _should_raise_guardrail_blocked_exception, and apply_guardrail, and backs it with comprehensive unit tests across both test trees.

Confidence Score: 5/5

Safe to merge — the fix is correct, targeted, and fully covered by new unit tests.

All findings are P2 style suggestions. The core null-safety change is correct: .get("key") or [] properly handles explicit JSON null from the Bedrock API where .get("key", []) does not. Coverage is comprehensive across all three affected methods and both test trees. No logic, security, or backwards-compatibility issues introduced.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/guardrails/guardrail_hooks/bedrock_guardrails.py	Correct null-safety fix: replaces .get("key", []) with .get("key") or [] on all iterable list fields across _redact_pii_matches, _should_raise_guardrail_blocked_exception, and apply_guardrail to handle Bedrock's explicit null responses.
tests/test_litellm/proxy/guardrails/guardrail_hooks/test_bedrock_guardrails.py	Three new test classes cover null-safety thoroughly: TestRedactPiiMatchesNullSafety, TestShouldRaiseGuardrailBlockedExceptionNullSafety, and TestApplyGuardrailNullSafety; all use mocks correctly and live in the unit-test folder.
tests/guardrails_tests/test_bedrock_guardrails.py	Three new standalone async test functions added; they only call synchronous helpers so the async def decoration is unnecessary overhead, but harmless.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Bedrock API response] --> B{assessments is null?}
    B -->|null - explicit None| C[or-fallback returns empty list]
    B -->|present| D[iterate assessments]
    C --> E[return / no-op safely]
    D --> F{sensitiveInformationPolicy present?}
    D --> G{topicPolicy present?}
    D --> H{contentPolicy present?}
    D --> I{wordPolicy present?}
    D --> J{contextualGroundingPolicy present?}
    F -->|yes| F1[piiEntities or-fallback / regexes or-fallback]
    G -->|yes| G1[topics or-fallback]
    H -->|yes| H1[filters or-fallback]
    I -->|yes| I1[customWords or-fallback / managedWordLists or-fallback]
    J -->|yes| J1[filters or-fallback]
    F1 --> K[safe iteration - no TypeError]
    G1 --> K
    H1 --> K
    I1 --> K
    J1 --> K

Loading

Comments Outside Diff (1)

1. tests/guardrails_tests/test_bedrock_guardrails.py, line 151-152 (link)

   Unnecessary async def on sync-only tests

   These three new test functions (test__redact_pii_matches_null_list_fields, test__redact_pii_matches_malformed_response, test_should_raise_guardrail_blocked_exception_null_fields) are declared async def and decorated with @pytest.mark.asyncio, but they only call synchronous functions — no await anywhere in their bodies. This creates a trivial asyncio event-loop per test with no benefit. Consider dropping async def / @pytest.mark.asyncio for these three functions to keep them consistent with normal unit tests.

_{Reviews (1): Last reviewed commit: "resolve merge conflicts: keep null-safet..." | Re-trigger Greptile}