Reject newline characters in base URL normalization

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/config.py

@@ -34,6 +34,8 @@ def normalize_base_url(base_url: str) -> str:
         normalized_base_url = base_url.strip().rstrip("/")
         if not normalized_base_url:
             raise HyperbrowserError("base_url must not be empty")
+        if "\n" in normalized_base_url or "\r" in normalized_base_url:
+            raise HyperbrowserError("base_url must not contain newline characters")
 
         parsed_base_url = urlparse(normalized_base_url)
         if (

tests/test_config.py

@@ -209,6 +209,11 @@ def test_client_config_rejects_empty_or_invalid_base_url():
     with pytest.raises(HyperbrowserError, match="must not include query parameters"):
         ClientConfig(api_key="test-key", base_url="https://example.local#frag")
 
+    with pytest.raises(
+        HyperbrowserError, match="base_url must not contain newline characters"
+    ):
+        ClientConfig(api_key="test-key", base_url="https://example.local/\napi")
+
 
 def test_client_config_normalizes_headers_to_internal_copy():
     headers = {"X-Correlation-Id": "abc123"}
@@ -313,3 +318,8 @@ def test_client_config_normalize_base_url_validates_and_normalizes():
 
     with pytest.raises(HyperbrowserError, match="must not include query parameters"):
         ClientConfig.normalize_base_url("https://example.local?foo=bar")
+
+    with pytest.raises(
+        HyperbrowserError, match="base_url must not contain newline characters"
+    ):
+        ClientConfig.normalize_base_url("https://example.local/\napi")

tests/test_url_building.py

@@ -98,6 +98,12 @@ def test_client_build_url_rejects_runtime_invalid_base_url_changes():
         ):
             client._build_url("/session")
 
+        client.config.base_url = "https://example.local/\napi"
+        with pytest.raises(
+            HyperbrowserError, match="base_url must not contain newline characters"
+        ):
+            client._build_url("/session")
+
         client.config.base_url = "   "
         with pytest.raises(HyperbrowserError, match="base_url must not be empty"):
             client._build_url("/session")