Validate _build_url path inputs for type and emptiness

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/client/base.py

@@ -55,7 +55,14 @@ def __init__(
         self.transport = transport(config.api_key, headers=config.headers)
 
     def _build_url(self, path: str) -> str:
-        normalized_path = path if path.startswith("/") else f"/{path}"
+        if not isinstance(path, str):
+            raise HyperbrowserError("path must be a string")
+        stripped_path = path.strip()
+        if not stripped_path:
+            raise HyperbrowserError("path must not be empty")
+        normalized_path = (
+            stripped_path if stripped_path.startswith("/") else f"/{stripped_path}"
+        )
         if normalized_path == "/api" or normalized_path.startswith("/api/"):
             return f"{self.config.base_url}{normalized_path}"
         return f"{self.config.base_url}/api{normalized_path}"

tests/test_url_building.py

@@ -1,5 +1,8 @@
+import pytest
+
 from hyperbrowser import Hyperbrowser
 from hyperbrowser.config import ClientConfig
+from hyperbrowser.exceptions import HyperbrowserError
 
 
 def test_client_build_url_normalizes_leading_slash():
@@ -29,3 +32,14 @@ def test_client_build_url_uses_normalized_base_url():
         assert client._build_url("/session") == "https://example.local/api/session"
     finally:
         client.close()
+
+
+def test_client_build_url_rejects_empty_or_non_string_paths():
+    client = Hyperbrowser(config=ClientConfig(api_key="test-key"))
+    try:
+        with pytest.raises(HyperbrowserError, match="path must not be empty"):
+            client._build_url("   ")
+        with pytest.raises(HyperbrowserError, match="path must be a string"):
+            client._build_url(123)  # type: ignore[arg-type]
+    finally:
+        client.close()