fix(proxy): add URL validation for user-supplied URLs

[stuxf]

Relevant issues

Adds SSRF protection for user-supplied URLs across multiple endpoints.

Reopens #25837 (original base litellm_yj_apr15 was deleted); rebased onto litellm_internal_staging. No content changes.

Pre-Submission checklist

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Type

🐛 Bug Fix

Changes

1. New shared utility: litellm/litellm_core_utils/url_utils.py

• validate_url(url) — resolves DNS, validates all IPs against private network ranges (RFC1918, link-local, loopback, IMDS, carrier-grade NAT). For HTTP URLs, rewrites the URL to the validated IP to prevent DNS rebinding. For HTTPS, relies on TLS certificate binding.
• safe_get(client, url) / async_safe_get(client, url) — fetch with SSRF protection on every redirect hop. Each redirect target is validated before the request is made. Caps at 10 redirects.

2. Applied to user-supplied URL entry points

• Image URL fetching (image_handling.py) — convert_url_to_base64 and async_convert_url_to_base64 now use safe_get/async_safe_get
• Token counter (token_counter.py) — image dimension fetching uses safe_get
• RAG ingestion (base_ingestion.py) — file URL fetching uses async_safe_get
• MCP OpenAPI spec loading (openapi_to_mcp_generator.py) — spec URL fetching uses async_safe_get

Protection against three SSRF vectors

• Direct private IP — blocked by IP validation
• DNS rebinding — blocked by resolve-and-rewrite (HTTP) or TLS certificate binding (HTTPS)
• Redirect chain to private IP — blocked by per-hop validation in safe_get

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 16, 2026 10:27pm

[codecov]

Codecov Report

❌ Patch coverage is 82.90598% with 20 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/litellm_core_utils/url_utils.py	85.14%	15 Missing ⚠️
litellm/litellm_core_utils/token_counter.py	77.77%	2 Missing ⚠️
...ellm_core_utils/prompt_templates/image_handling.py	66.66%	1 Missing ⚠️
...xperimental/mcp_server/openapi_to_mcp_generator.py	50.00%	1 Missing ⚠️
litellm/rag/ingestion/base_ingestion.py	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

This PR adds SSRF protection to all user-supplied URL entry points (image fetching, token counting, RAG ingestion, MCP OpenAPI spec loading) via a new url_utils.py module. The implementation uses DNS resolve-and-rewrite for HTTP (preventing rebinding), hop-by-hop redirect validation, and TLS certificate binding for HTTPS. Admin escape hatches (user_url_validation toggle and user_url_allowed_hosts allowlist) are wired through litellm.__init__. The Azure Wire Server (168.63.129.16) is explicitly added to the cloud-metadata exception list, and the RFC 6890 ip.is_global check covers the remaining private ranges. Previous review concerns have been addressed.

Confidence Score: 5/5

Safe to merge — SSRF protection is correctly implemented with no active bugs in current callers.

All previously raised concerns (inline httpx import, Azure Wire Server gap, no opt-out for internal hosts) have been addressed. Remaining findings are P2: the async retry loop silently swallows SSRFError without logging (sync path does log), and the **kwargs pass-through creates a latent TypeError risk for future callers using HTTPHandler. Neither affects correctness today.

litellm/litellm_core_utils/prompt_templates/image_handling.py (silent SSRFError in async retry loop)

Important Files Changed

Filename	Overview
litellm/litellm_core_utils/url_utils.py	New SSRF utility: DNS resolve-and-rewrite for HTTP, TLS binding for HTTPS, RFC 6890 is_global check plus Azure Wire Server exception, per-hop redirect validation, admin allowlist and master switch.
litellm/litellm_core_utils/prompt_templates/image_handling.py	Replaces bare client.get() with safe_get/async_safe_get; async path silently swallows SSRFError across all 3 retries with no log entry, while sync path does log it.
litellm/litellm_core_utils/token_counter.py	get_image_dimensions now guards URL fetch behind startswith check and uses safe_get; SSRFError is silently swallowed and falls through to base64 decode (same behaviour as prior network failures).
litellm/rag/ingestion/base_ingestion.py	Single-line swap of client.get() to async_safe_get(); SSRFError propagates to caller unchanged, which is acceptable.
litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py	Single-line swap to async_safe_get() for HTTP spec loading; SSRF validation applied before spec fetch.
tests/test_litellm/litellm_core_utils/test_url_utils.py	Comprehensive mocked unit tests covering blocked IPs, DNS failure, allowlist, redirect hostname preservation, and master switch — no real network calls.
tests/test_litellm/litellm_core_utils/test_image_handling.py	Uses autouse fixture to bypass SSRF in image handling tests; existing size-limit and streaming tests preserved with no weakened assertions.
tests/mcp_tests/test_openapi_spec_path_url.py	Mocked async handler tests for URL and local-file spec loading; correctly monkeypatches async_safe_get to bypass DNS in test environment.
litellm/init.py	Adds user_url_validation (bool, default True) and user_url_allowed_hosts (List[str], default []) globals for admin opt-out.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User-supplied URL] --> B{user_url_validation\nenabled?}
    B -- No --> C[client.get with follow_redirects=True]
    B -- Yes --> D[validate_url]
    D --> E{Scheme\nhttp/https?}
    E -- No --> F[SSRFError: scheme not allowed]
    E -- Yes --> G[socket.getaddrinfo]
    G --> H{DNS\nresolution OK?}
    H -- No --> I[SSRFError: DNS failed]
    H -- Yes --> J{Host in\nallowlist?}
    J -- No --> K{All IPs\nglobal + not\ncloud-fabric?}
    K -- No --> L[SSRFError: blocked address]
    K -- Yes --> M{HTTPS +\nssl_verify=True?}
    J -- Yes --> M
    M -- Yes --> N[Return original URL\nTLS pins hostname]
    M -- No --> O[Rewrite URL to\nvalidated IP]
    N --> P[client.get\nfollow_redirects=False]
    O --> P
    P --> Q{Response\nis redirect?}
    Q -- No --> R[Return response]
    Q -- Yes --> S{Redirect\ncount < 10?}
    S -- No --> T[SSRFError: too many redirects]
    S -- Yes --> U[Extract Location header\nresolve vs original hostname]
    U --> D

Loading

_{Reviews (5): Last reviewed commit: "style: use 'is not None' for port check ..." | Re-trigger Greptile}