Reject control characters in file utility messages

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/client/file_utils.py

@@ -15,10 +15,22 @@ def ensure_existing_file_path(
         raise HyperbrowserError("missing_file_message must be a string")
     if not missing_file_message.strip():
         raise HyperbrowserError("missing_file_message must not be empty")
+    if any(
+        ord(character) < 32 or ord(character) == 127
+        for character in missing_file_message
+    ):
+        raise HyperbrowserError(
+            "missing_file_message must not contain control characters"
+        )
     if not isinstance(not_file_message, str):
         raise HyperbrowserError("not_file_message must be a string")
     if not not_file_message.strip():
         raise HyperbrowserError("not_file_message must not be empty")
+    if any(
+        ord(character) < 32 or ord(character) == 127
+        for character in not_file_message
+    ):
+        raise HyperbrowserError("not_file_message must not contain control characters")
     try:
         normalized_path = os.fspath(file_path)
     except HyperbrowserError:

tests/test_file_utils.py

@@ -46,6 +46,23 @@ def test_ensure_existing_file_path_rejects_blank_missing_message(tmp_path: Path)
         )
 
 
+def test_ensure_existing_file_path_rejects_control_chars_in_missing_message(
+    tmp_path: Path,
+):
+    file_path = tmp_path / "file.txt"
+    file_path.write_text("content")
+
+    with pytest.raises(
+        HyperbrowserError,
+        match="missing_file_message must not contain control characters",
+    ):
+        ensure_existing_file_path(
+            str(file_path),
+            missing_file_message="missing\tmessage",
+            not_file_message="not-file",
+        )
+
+
 def test_ensure_existing_file_path_rejects_non_string_not_file_message(tmp_path: Path):
     file_path = tmp_path / "file.txt"
     file_path.write_text("content")
@@ -70,6 +87,23 @@ def test_ensure_existing_file_path_rejects_blank_not_file_message(tmp_path: Path
         )
 
 
+def test_ensure_existing_file_path_rejects_control_chars_in_not_file_message(
+    tmp_path: Path,
+):
+    file_path = tmp_path / "file.txt"
+    file_path.write_text("content")
+
+    with pytest.raises(
+        HyperbrowserError,
+        match="not_file_message must not contain control characters",
+    ):
+        ensure_existing_file_path(
+            str(file_path),
+            missing_file_message="missing",
+            not_file_message="not-file\nmessage",
+        )
+
+
 def test_ensure_existing_file_path_accepts_pathlike_inputs(tmp_path: Path):
     file_path = tmp_path / "pathlike-file.txt"
     file_path.write_text("content")