Validate decoded base URL components are strings

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/config.py

@@ -60,7 +60,10 @@ def _decode_url_component_with_limit(value: str, *, component_label: str) -> str
     @staticmethod
     def _safe_unquote(value: str, *, component_label: str) -> str:
         try:
-            return unquote(value)
+            decoded_value = unquote(value)
+            if not isinstance(decoded_value, str):
+                raise TypeError("decoded URL component must be a string")
+            return decoded_value
         except HyperbrowserError:
             raise
         except Exception as exc:

tests/test_config.py

@@ -503,6 +503,20 @@ def _raise_hyperbrowser_error(_value: str) -> str:
     assert exc_info.value.original_error is None
 
 
+def test_client_config_normalize_base_url_wraps_non_string_decode_results(
+    monkeypatch: pytest.MonkeyPatch,
+):
+    def _return_bytes(_value: str) -> bytes:
+        return b"/api"
+
+    monkeypatch.setattr(config_module, "unquote", _return_bytes)
+
+    with pytest.raises(HyperbrowserError, match="Failed to decode base_url path") as exc_info:
+        ClientConfig.normalize_base_url("https://example.local/api")
+
+    assert exc_info.value.original_error is not None
+
+
 def test_client_config_normalize_base_url_preserves_invalid_port_original_error():
     with pytest.raises(
         HyperbrowserError, match="base_url must contain a valid port number"