[Security] Harden message sanitization (#58832)

Signed-off-by: DarkLight1337 <tlleungac@connect.ust.hk>

tests/entrypoints/serve/exception_handling/test_error_sanitization.py

@@ -18,6 +18,10 @@ def test_sanitize_message():
         sanitize_message("<_io.BytesIO object at 0x7a95e299e750>")
         == "<_io.BytesIO object>"
     )
+    assert (
+        sanitize_message("<PIL.Image.Image image mode=RGB size=2x2 at 0x7D52EAF07BF0>")
+        == "<PIL.Image.Image image mode=RGB size=2x2>"
+    )
 
 
 class TestSanitizeMessageFilePaths:

vllm/entrypoints/serve/exception_handling/utils.py

@@ -6,7 +6,7 @@ import regex as re
 
 def sanitize_message(message: str) -> str:
     """Strip memory addresses, tracebacks, and file paths from error messages."""
-    message = re.sub(r" at 0x[0-9a-f]+>", ">", message)
+    message = re.sub(r" at 0x[0-9a-fA-F]+>", ">", message)
     message = re.sub(r'\n?\s*File "[^"]+", line \d+, in \S+(\n\s+.*)?', "", message)
     message = re.sub(
         r"/(?:home|usr|opt|var|tmp|root|lib|mnt|srv)(?:/[\w.\-]+)+", "<path>", message