fix: reject transport headers as model-rewrite promotion targets - #974
fix: reject transport headers as model-rewrite promotion targets#974mkoushni wants to merge 11 commits into
Conversation
…xis-proxy#554) Configurable effective/original model headers could previously name Content-Length, Host, or hop-by-hop headers and conflict with framing. Share the blocked-name check with API-client forward-header validation and reject duplicate promotion names. Signed-off-by: mkoushni <mkoushni@redhat.com>
The postgres vLLM job co-locates Postgres, vLLM, and OGX; the shipped chat file-search example still uses a 60s IRR step and 5s callout, so a slow CPU inference can 504 before the 300s OpenAI client timeout. Match the native file-search template deadlines in the CI-only patcher. Signed-off-by: mkoushni <mkoushni@redhat.com>
Compose the promotion-header denylist on http_hop plus Host and Content-Length after outbound hop-by-hop sanitization landed on main. Signed-off-by: mkoushni <mkoushni@redhat.com>
leseb
left a comment
leseb
left a comment
There was a problem hiding this comment.
P1: promotion.rs:29 still permits authorization and unrelated internal x-praxis-* targets. A client model such as Bearer attacker can overwrite upstream credentials or routing facts.
P1: The class-level fix is missing from Anthropic config:122 and Responses-format config:112, which retain syntax-only validation before promoting body-derived values. Issue #554 explicitly requires these sibling sinks to be fixed.
P2: Generated documentation:17 omits the new requirement that original/effective header names must differ.
…-promotion-headers Signed-off-by: mkoushni <mkoushni@redhat.com>
Block Authorization and x-praxis-* names outside the AI fact namespaces so a client model cannot overwrite credentials or routing. Apply the same validator to Responses and Anthropic format classifiers, and document that original/effective rewrite headers must differ. Signed-off-by: mkoushni <mkoushni@redhat.com>
|
> P1: promotion.rs:29 still permits authorization and unrelated internal x-praxis-* targets. A client model such as Bearer attacker can overwrite upstream credentials or routing facts. P1: The class-level fix is missing from Anthropic config:122 and Responses-format config:112, which retain syntax-only validation before promoting body-derived values. Issue #554 explicitly requires these sibling sinks to be fixed. P2: Generated documentation:17 omits the new requirement that original/effective header names must differ. P1 credentials / internal headers. Promotion targets now reject authorization/cookie/set-cookie/www-authenticate and x-praxis-* names outside the AI fact namespaces (x-praxis-ai-, x-praxis-responses-). Defaults such as x-praxis-ai-effective-model and x-praxis-responses-mode stay allowed. forward_headers still uses only the transport list, so Authorization can still be forwarded to APIs. P1 sibling sinks. openai_responses_format and anthropic_messages_format use the same validate_promotion_header helper. P2 docs. Generated model-rewrite docs now say effective_model and original_model must use distinct names. |
CI clippy -D unwrap_used failed on unwrap_err in the new authorization rejection test. Match the crate's existing test-module suppressions. Signed-off-by: mkoushni <mkoushni@redhat.com>
…-promotion-headers Signed-off-by: mkoushni <mkoushni@redhat.com>
2 participants
Summary
openai_responses_model_rewritepreviously accepted any syntactically valid HTTP header name forheaders.effective_modelandheaders.original_model. That allowed configs such aseffective_model: content-lengthto promote a client-derived model string onto hop-by-hop, framing,Host, or proxy-auth headers.forward_headersvalidation viais_transport_controlled_header.Default
x-praxis-ai-*promotion headers are unchanged.Related issue
Closes #554
Validation
make lintCovered by
openai_responses_model_rewriteandpromotionunit tests.make coverage-checkpassed at 96.06% line coverage.cargo clippy -p praxis-ai-apis --all-targets -- -D warningspassed. No new example config is required; existing defaults remain valid.Checklist
Signed-off-bytrailer.Breaking changes
Configs that named a hop-by-hop, framing,
Host, or proxy-auth header as a model-rewrite promotion target, or that used the same header for both promoted values, now fail at filter construction.