fix: sanitize NO_PROXY env var to handle newline-separated values

src/openai/_client.py

@@ -92,6 +92,32 @@
 WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER = "workload-identity-auth"
 
 
+def _sanitize_proxy_env() -> None:
+    """Normalize newline-separated values in the proxy environment variables.
+
+    Only called when we are about to construct the default httpx client, which reads
+    these variables via ``trust_env``. When the caller supplies their own ``http_client``
+    we must not touch the process-wide environment, as that client may deliberately
+    ignore it (e.g. ``trust_env=False``) and other code in the process can observe
+    the mutation.
+    """
+    for env_var in (
+        "NO_PROXY",
+        "no_proxy",
+        "HTTP_PROXY",
+        "http_proxy",
+        "HTTPS_PROXY",
+        "https_proxy",
+        "ALL_PROXY",
+        "all_proxy",
+    ):
+        value = os.environ.get(env_var)
+        if value is not None and ("\n" in value or "\r" in value):
+            os.environ[env_var] = ",".join(
+                part.strip() for part in value.replace("\r\n", "\n").replace("\r", "\n").split("\n") if part.strip()
+            )
+
+
 def _has_header(headers: Headers, header: str) -> bool:
     header = header.lower()
     return any(key.lower() == header for key in headers)
@@ -164,6 +190,8 @@ def __init__(
 
         When `provider` is supplied, authentication and the base URL are configured by that provider instead.
         """
+        if http_client is None:
+            _sanitize_proxy_env()
         provider_runtime: _ProviderRuntime | None = None
         if provider is not None:
             provider_name = _provider_name(provider)
@@ -760,6 +788,8 @@ def __init__(
 
         When `provider` is supplied, authentication and the base URL are configured by that provider instead.
         """
+        if http_client is None:
+            _sanitize_proxy_env()
         provider_runtime: _ProviderRuntime | None = None
         if provider is not None:
             provider_name = _provider_name(provider)

tests/test_client.py

@@ -1292,6 +1292,29 @@ def test_proxy_environment_variables(self, monkeypatch: pytest.MonkeyPatch) -> N
         assert len(mounts) == 1
         assert mounts[0][0].pattern == "https://"
 
+    def test_proxy_env_sanitized_for_default_client(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setenv("NO_PROXY", "127.0.0.1\nlocalhost\r\nexample.com\n")
+
+        OpenAI(base_url=base_url, api_key=api_key, _strict_response_validation=True)
+
+        assert os.environ["NO_PROXY"] == "127.0.0.1,localhost,example.com"
+
+    def test_proxy_env_untouched_when_http_client_supplied(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        # A caller-supplied client may deliberately ignore the proxy environment
+        # (trust_env=False), so we must not mutate it process-wide on their behalf.
+        raw = "127.0.0.1\nlocalhost\r\nexample.com\n"
+        monkeypatch.setenv("NO_PROXY", raw)
+
+        with httpx.Client(trust_env=False) as http_client:
+            OpenAI(
+                base_url=base_url,
+                api_key=api_key,
+                _strict_response_validation=True,
+                http_client=http_client,
+            )
+
+        assert os.environ["NO_PROXY"] == raw
+
     @pytest.mark.filterwarnings("ignore:.*deprecated.*:DeprecationWarning")
     def test_default_client_creation(self) -> None:
         # Ensure that the client can be initialized without any exceptions
@@ -2552,6 +2575,29 @@ async def test_proxy_environment_variables(self, monkeypatch: pytest.MonkeyPatch
         assert len(mounts) == 1
         assert mounts[0][0].pattern == "https://"
 
+    async def test_proxy_env_sanitized_for_default_client(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        monkeypatch.setenv("NO_PROXY", "127.0.0.1\nlocalhost\r\nexample.com\n")
+
+        AsyncOpenAI(base_url=base_url, api_key=api_key, _strict_response_validation=True)
+
+        assert os.environ["NO_PROXY"] == "127.0.0.1,localhost,example.com"
+
+    async def test_proxy_env_untouched_when_http_client_supplied(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        # A caller-supplied client may deliberately ignore the proxy environment
+        # (trust_env=False), so we must not mutate it process-wide on their behalf.
+        raw = "127.0.0.1\nlocalhost\r\nexample.com\n"
+        monkeypatch.setenv("NO_PROXY", raw)
+
+        async with httpx.AsyncClient(trust_env=False) as http_client:
+            AsyncOpenAI(
+                base_url=base_url,
+                api_key=api_key,
+                _strict_response_validation=True,
+                http_client=http_client,
+            )
+
+        assert os.environ["NO_PROXY"] == raw
+
     @pytest.mark.filterwarnings("ignore:.*deprecated.*:DeprecationWarning")
     async def test_default_client_creation(self) -> None:
         # Ensure that the client can be initialized without any exceptions