Reject control characters in polling operation names

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/client/polling.py

@@ -31,6 +31,10 @@ def _validate_operation_name(operation_name: str) -> None:
         raise HyperbrowserError("operation_name must be a string")
     if not operation_name.strip():
         raise HyperbrowserError("operation_name must not be empty")
+    if any(
+        ord(character) < 32 or ord(character) == 127 for character in operation_name
+    ):
+        raise HyperbrowserError("operation_name must not contain control characters")
 
 
 def _validate_retry_config(

tests/test_polling.py

@@ -667,6 +667,16 @@ def test_polling_helpers_validate_retry_and_interval_configuration():
             retry_delay_seconds=0,
         )
 
+    with pytest.raises(
+        HyperbrowserError, match="operation_name must not contain control characters"
+    ):
+        retry_operation(
+            operation_name="invalid\nretry",
+            operation=lambda: "ok",
+            max_attempts=1,
+            retry_delay_seconds=0,
+        )
+
     with pytest.raises(HyperbrowserError, match="max_attempts must be an integer"):
         retry_operation(
             operation_name="invalid-retry-type",
@@ -804,5 +814,16 @@ async def validate_async_operation_name() -> None:
                 poll_interval_seconds=0.1,
                 max_wait_seconds=1.0,
             )
+        with pytest.raises(
+            HyperbrowserError,
+            match="operation_name must not contain control characters",
+        ):
+            await poll_until_terminal_status_async(
+                operation_name="invalid\tasync",
+                get_status=lambda: asyncio.sleep(0, result="completed"),
+                is_terminal_status=lambda value: value == "completed",
+                poll_interval_seconds=0.1,
+                max_wait_seconds=1.0,
+            )
 
     asyncio.run(validate_async_operation_name())