fix: reject transport headers as model-rewrite promotion targets - #974
Open
mkoushni wants to merge 6 commits into
Open
fix: reject transport headers as model-rewrite promotion targets#974mkoushni wants to merge 6 commits into
mkoushni wants to merge 6 commits into
Conversation
…xis-proxy#554) Configurable effective/original model headers could previously name Content-Length, Host, or hop-by-hop headers and conflict with framing. Share the blocked-name check with API-client forward-header validation and reject duplicate promotion names. Signed-off-by: mkoushni <mkoushni@redhat.com>
The postgres vLLM job co-locates Postgres, vLLM, and OGX; the shipped chat file-search example still uses a 60s IRR step and 5s callout, so a slow CPU inference can 504 before the 300s OpenAI client timeout. Match the native file-search template deadlines in the CI-only patcher. Signed-off-by: mkoushni <mkoushni@redhat.com>
Compose the promotion-header denylist on http_hop plus Host and Content-Length after outbound hop-by-hop sanitization landed on main. Signed-off-by: mkoushni <mkoushni@redhat.com>
leseb
requested changes
Sep 7, 2026
leseb
left a comment
leseb
left a comment
Contributor
There was a problem hiding this comment.
P1: promotion.rs:29 still permits authorization and unrelated internal x-praxis-* targets. A client model such as Bearer attacker can overwrite upstream credentials or routing facts.
P1: The class-level fix is missing from Anthropic config:122 and Responses-format config:112, which retain syntax-only validation before promoting body-derived values. Issue #554 explicitly requires these sibling sinks to be fixed.
P2: Generated documentation:17 omits the new requirement that original/effective header names must differ.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openai_responses_model_rewritepreviously accepted any syntactically valid HTTP header name forheaders.effective_modelandheaders.original_model. That allowed configs such aseffective_model: content-lengthto promote a client-derived model string onto hop-by-hop, framing,Host, or proxy-auth headers.forward_headersvalidation viais_transport_controlled_header.Default
x-praxis-ai-*promotion headers are unchanged.Related issue
Closes #554
Validation
make lintCovered by
openai_responses_model_rewriteandpromotionunit tests.make coverage-checkpassed at 96.06% line coverage.cargo clippy -p praxis-ai-apis --all-targets -- -D warningspassed. No new example config is required; existing defaults remain valid.Checklist
Signed-off-bytrailer.Breaking changes
Configs that named a hop-by-hop, framing,
Host, or proxy-auth header as a model-rewrite promotion target, or that used the same header for both promoted values, now fail at filter construction.