Reject base URLs with query strings or fragments

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/config.py

@@ -36,6 +36,10 @@ def __post_init__(self) -> None:
             raise HyperbrowserError(
                 "base_url must start with 'https://' or 'http://' and include a host"
             )
+        if parsed_base_url.query or parsed_base_url.fragment:
+            raise HyperbrowserError(
+                "base_url must not include query parameters or fragments"
+            )
         self.headers = normalize_headers(
             self.headers,
             mapping_error_message="headers must be a mapping of string pairs",

tests/test_config.py

@@ -125,6 +125,14 @@ def test_client_config_from_env_rejects_base_url_without_host(monkeypatch):
         ClientConfig.from_env()
 
 
+def test_client_config_from_env_rejects_base_url_query_or_fragment(monkeypatch):
+    monkeypatch.setenv("HYPERBROWSER_API_KEY", "test-key")
+    monkeypatch.setenv("HYPERBROWSER_BASE_URL", "https://example.local?x=1")
+
+    with pytest.raises(HyperbrowserError, match="must not include query parameters"):
+        ClientConfig.from_env()
+
+
 def test_client_config_normalizes_whitespace_and_trailing_slash():
     config = ClientConfig(api_key="  test-key  ", base_url=" https://example.local/ ")
 
@@ -156,6 +164,9 @@ def test_client_config_rejects_empty_or_invalid_base_url():
     with pytest.raises(HyperbrowserError, match="include a host"):
         ClientConfig(api_key="test-key", base_url="http://")
 
+    with pytest.raises(HyperbrowserError, match="must not include query parameters"):
+        ClientConfig(api_key="test-key", base_url="https://example.local#frag")
+
 
 def test_client_config_normalizes_headers_to_internal_copy():
     headers = {"X-Correlation-Id": "abc123"}