Validate raw query input for unencoded control characters

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/client/base.py

@@ -88,6 +88,16 @@ def _build_url(self, path: str) -> str:
             raise HyperbrowserError("path must be a relative API path")
         if parsed_path.fragment:
             raise HyperbrowserError("path must not include URL fragments")
+        raw_query_component = (
+            stripped_path.split("?", 1)[1] if "?" in stripped_path else ""
+        )
+        if any(
+            character.isspace() or ord(character) < 32 or ord(character) == 127
+            for character in raw_query_component
+        ):
+            raise HyperbrowserError(
+                "path query must not contain unencoded whitespace or control characters"
+            )
         if any(
             character.isspace() or ord(character) < 32 or ord(character) == 127
             for character in parsed_path.query

tests/test_url_building.py

@@ -329,6 +329,11 @@ def test_client_build_url_rejects_empty_or_non_string_paths():
         with pytest.raises(
             HyperbrowserError,
             match="path query must not contain unencoded whitespace or control characters",
+        ):
+            client._build_url("/session?foo=bar\tbaz")
+        with pytest.raises(
+            HyperbrowserError,
+            match="path query must not contain unencoded whitespace or control characters",
         ):
             client._build_url("/session?foo=bar\x00baz")
         nested_encoded_segment = "%2e"