Harden URL path checks against deeply encoded payloads

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/client/base.py

@@ -91,7 +91,7 @@ def _build_url(self, path: str) -> str:
             f"?{normalized_parts.query}" if normalized_parts.query else ""
         )
         decoded_path = normalized_path_only
-        for _ in range(3):
+        for _ in range(10):
             next_decoded_path = unquote(decoded_path)
             if next_decoded_path == decoded_path:
                 break

tests/test_url_building.py

@@ -176,6 +176,10 @@ def test_client_build_url_rejects_empty_or_non_string_paths():
             HyperbrowserError, match="path must not contain relative path segments"
         ):
             client._build_url("/%252e%252e/session")
+        with pytest.raises(
+            HyperbrowserError, match="path must not contain relative path segments"
+        ):
+            client._build_url("/%2525252e%2525252e/session")
         with pytest.raises(
             HyperbrowserError, match="path must not contain backslashes"
         ):
@@ -184,6 +188,10 @@ def test_client_build_url_rejects_empty_or_non_string_paths():
             HyperbrowserError, match="path must not contain backslashes"
         ):
             client._build_url("/api/%255Csession")
+        with pytest.raises(
+            HyperbrowserError, match="path must not contain backslashes"
+        ):
+            client._build_url("/api/%2525255Csession")
         with pytest.raises(
             HyperbrowserError, match="path must not contain newline characters"
         ):