feat: add strict policy option for enforcing base URL

[yordis]

Add an opt-in policy: :strict option to the BaseUrl middleware that enforces
base URL prepending regardless of whether the request URL already includes a scheme.
This addresses security concerns when user input controls the URL parameter,
preventing potential URL redirection attacks.

Signed-off-by: Yordis Prieto yordis.prieto@gmail.com

[cursor]

PR Summary

Adds a :strict policy to BaseUrl middleware, introduces keyword options parsing/validation, updates docs/types, and expands tests including edge cases and backward compatibility.

• Middleware (lib/tesla/middleware/base_url.ex)
  • Add policy option with :strict | :insecure (default :insecure); :strict always prepends base URL.
  • Support options as keyword list with :base_url and :policy, or string for backward compatibility.
  • New parse_opts!/1, get_policy!/1, and updated apply_base/3 with validation and typespecs.
  • Expanded moduledoc with options, security note, and examples.
• Tests (test/tesla/middleware/base_url_test.exs)
  • Add cases for :strict behavior (absolute and relative URLs), default behavior, case-insensitive schemes.
  • Validate invalid policy values raise errors; ensure string/keyword input compatibility.
  • Cover edge cases (empty base_url, strict with empty base).

^{Written by Cursor Bugbot for commit 5480e78. This will update automatically on new commits. Configure here.}

[Copilot]

Pull request overview

This PR adds a strict policy option to the BaseUrl middleware to address security concerns when user-controlled input determines the request URL. The strict mode ensures the base URL is always prepended, preventing potential URL redirection attacks.

Key Changes:

• Introduces policy: :strict option to enforce base URL prepending even when URLs contain schemes
• Refactors option parsing to support both keyword list format (:base_url + :policy) and backward-compatible string format
• Adds comprehensive test coverage for strict policy behavior and validation

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

File	Description
lib/tesla/middleware/base_url.ex	Implements strict/insecure policy logic with new option parsing; updates documentation with examples and security guidance
test/tesla/middleware/base_url_test.exs	Adds test coverage for strict policy behavior, policy validation, backward compatibility, and edge cases

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.