Reject encoded credential delimiters in base URL hosts

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/config.py

@@ -103,7 +103,7 @@ def normalize_base_url(base_url: str) -> str:
             for character in decoded_base_netloc
         ):
             raise HyperbrowserError("base_url host must not contain control characters")
-        if any(character in {"?", "#", "/"} for character in decoded_base_netloc):
+        if any(character in {"?", "#", "/", "@"} for character in decoded_base_netloc):
             raise HyperbrowserError(
                 "base_url host must not contain encoded delimiter characters"
             )

tests/test_config.py

@@ -410,6 +410,11 @@ def test_client_config_normalize_base_url_validates_and_normalizes():
         match="base_url host must not contain encoded delimiter characters",
     ):
         ClientConfig.normalize_base_url("https://example.local%252Fapi")
+    with pytest.raises(
+        HyperbrowserError,
+        match="base_url host must not contain encoded delimiter characters",
+    ):
+        ClientConfig.normalize_base_url("https://example.local%2540attacker.com")
     with pytest.raises(
         HyperbrowserError,
         match="base_url path must not contain encoded query or fragment delimiters",

tests/test_url_building.py

@@ -143,6 +143,13 @@ def test_client_build_url_rejects_runtime_invalid_base_url_changes():
         ):
             client._build_url("/session")
 
+        client.config.base_url = "https://example.local%40attacker.com"
+        with pytest.raises(
+            HyperbrowserError,
+            match="base_url host must not contain encoded delimiter characters",
+        ):
+            client._build_url("/session")
+
         client.config.base_url = "https://user:pass@example.local"
         with pytest.raises(
             HyperbrowserError, match="base_url must not include user credentials"