Skip to content

fix: sanitize NO_PROXY newlines #3305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nightcityblade wants to merge 1 commit into
base: main
Choose a base branch
from
+38 −0
Open

fix: sanitize NO_PROXY newlines #3305

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions src/openai/_base_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
from __future__ import annotations

import os
import sys
import json
import time
Expand Down Expand Up @@ -809,11 +810,25 @@ def _idempotency_key(self) -> str:
return f"stainless-python-retry-{uuid.uuid4()}"


def _sanitize_no_proxy(value: str) -> str:
if "\n" not in value and "\r" not in value:
return value

return ",".join(part.strip() for part in value.replace("\r", ",").replace("\n", ",").split(",") if part.strip())


class _DefaultHttpxClient(httpx.Client):
def __init__(self, **kwargs: Any) -> None:
kwargs.setdefault("timeout", DEFAULT_TIMEOUT)
kwargs.setdefault("limits", DEFAULT_CONNECTION_LIMITS)
kwargs.setdefault("follow_redirects", True)

if kwargs.get("trust_env", True):
for key in ("NO_PROXY", "no_proxy"):
value = os.environ.get(key)
if value is not None:
os.environ[key] = _sanitize_no_proxy(value)
Comment on lines +829 to +830
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid mutating process env while constructing clients

Writing the sanitized value back into os.environ makes client construction mutate global process state, so creating one SDK client permanently rewrites NO_PROXY/no_proxy for all other code in the same process. This can cause hard-to-debug cross-library side effects (or racey behavior in multi-threaded apps) unrelated to this client instance; the sanitization should be scoped to the httpx initialization path rather than persisted globally.

Useful? React with 👍 / 👎.


super().__init__(**kwargs)


Expand Down Expand Up @@ -1388,6 +1403,13 @@ def __init__(self, **kwargs: Any) -> None:
kwargs.setdefault("timeout", DEFAULT_TIMEOUT)
kwargs.setdefault("limits", DEFAULT_CONNECTION_LIMITS)
kwargs.setdefault("follow_redirects", True)

if kwargs.get("trust_env", True):
for key in ("NO_PROXY", "no_proxy"):
value = os.environ.get(key)
if value is not None:
os.environ[key] = _sanitize_no_proxy(value)

super().__init__(**kwargs)


Expand Down
16 changes: 16 additions & 0 deletions tests/test_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1043,6 +1043,14 @@ def test_proxy_environment_variables(self, monkeypatch: pytest.MonkeyPatch) -> N
assert len(mounts) == 1
assert mounts[0][0].pattern == "https://"

def test_no_proxy_environment_variable_with_newlines(self, monkeypatch: pytest.MonkeyPatch) -> None:
monkeypatch.setenv("NO_PROXY", "localhost\n192.168.1.1")

client = DefaultHttpxClient()

patterns = {mount.pattern for mount in client._mounts}
assert patterns == {"all://localhost", "all://192.168.1.1"}

@pytest.mark.filterwarnings("ignore:.*deprecated.*:DeprecationWarning")
def test_default_client_creation(self) -> None:
# Ensure that the client can be initialized without any exceptions
Expand Down Expand Up @@ -2086,6 +2094,14 @@ async def test_proxy_environment_variables(self, monkeypatch: pytest.MonkeyPatch
assert len(mounts) == 1
assert mounts[0][0].pattern == "https://"

async def test_no_proxy_environment_variable_with_newlines(self, monkeypatch: pytest.MonkeyPatch) -> None:
monkeypatch.setenv("NO_PROXY", "localhost\n192.168.1.1")

client = DefaultAsyncHttpxClient()

patterns = {mount.pattern for mount in client._mounts}
assert patterns == {"all://localhost", "all://192.168.1.1"}

@pytest.mark.filterwarnings("ignore:.*deprecated.*:DeprecationWarning")
async def test_default_client_creation(self) -> None:
# Ensure that the client can be initialized without any exceptions
Expand Down