Skip to content

fix: sanitize NO_PROXY env vars containing newline characters #3304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JiwaniZakir wants to merge 1 commit into
base: main
Choose a base branch
from
+34 −0
Open

fix: sanitize NO_PROXY env vars containing newline characters #3304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/openai/_base_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
from __future__ import annotations

import os
import sys
import json
import time
Expand Down Expand Up @@ -831,11 +832,19 @@ def _idempotency_key(self) -> str:
return f"stainless-python-retry-{uuid.uuid4()}"


def _sanitize_proxy_env_vars() -> None:
for key in ("NO_PROXY", "no_proxy"):
val = os.environ.get(key)
if val and "\n" in val:
os.environ[key] = ",".join(part.strip() for part in val.replace("\n", ",").split(",") if part.strip())


class _DefaultHttpxClient(httpx.Client):
def __init__(self, **kwargs: Any) -> None:
kwargs.setdefault("timeout", DEFAULT_TIMEOUT)
kwargs.setdefault("limits", DEFAULT_CONNECTION_LIMITS)
kwargs.setdefault("follow_redirects", True)
_sanitize_proxy_env_vars()
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Skip NO_PROXY sanitization when trust_env is false

Calling _sanitize_proxy_env_vars() unconditionally in DefaultHttpxClient mutates process-wide environment variables even when the caller passes trust_env=False, which is supposed to disable environment-based proxy behavior. In that scenario, creating an SDK client still rewrites NO_PROXY/no_proxy for the entire process, potentially changing proxy behavior for other libraries or later subprocesses that read the same env vars. Gate this sanitization on kwargs.get("trust_env", True) (and similarly for async) to avoid unexpected global side effects.

Useful? React with 👍 / 👎.

super().__init__(**kwargs)


Expand Down Expand Up @@ -1423,6 +1432,7 @@ def __init__(self, **kwargs: Any) -> None:
kwargs.setdefault("timeout", DEFAULT_TIMEOUT)
kwargs.setdefault("limits", DEFAULT_CONNECTION_LIMITS)
kwargs.setdefault("follow_redirects", True)
_sanitize_proxy_env_vars()
super().__init__(**kwargs)


Expand Down
24 changes: 24 additions & 0 deletions tests/test_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1292,6 +1292,18 @@ def test_proxy_environment_variables(self, monkeypatch: pytest.MonkeyPatch) -> N
assert len(mounts) == 1
assert mounts[0][0].pattern == "https://"

def test_no_proxy_with_newlines(self, monkeypatch: pytest.MonkeyPatch) -> None:
monkeypatch.setenv("NO_PROXY", "localhost\n127.0.0.1\n")
monkeypatch.delenv("no_proxy", raising=False)
client = DefaultHttpxClient()
assert client is not None

def test_no_proxy_lowercase_with_newlines(self, monkeypatch: pytest.MonkeyPatch) -> None:
monkeypatch.setenv("no_proxy", "localhost\n127.0.0.1\n")
monkeypatch.delenv("NO_PROXY", raising=False)
client = DefaultHttpxClient()
assert client is not None

@pytest.mark.filterwarnings("ignore:.*deprecated.*:DeprecationWarning")
def test_default_client_creation(self) -> None:
# Ensure that the client can be initialized without any exceptions
Expand Down Expand Up @@ -2552,6 +2564,18 @@ async def test_proxy_environment_variables(self, monkeypatch: pytest.MonkeyPatch
assert len(mounts) == 1
assert mounts[0][0].pattern == "https://"

async def test_no_proxy_with_newlines(self, monkeypatch: pytest.MonkeyPatch) -> None:
monkeypatch.setenv("NO_PROXY", "localhost\n127.0.0.1\n")
monkeypatch.delenv("no_proxy", raising=False)
client = DefaultAsyncHttpxClient()
assert client is not None

async def test_no_proxy_lowercase_with_newlines(self, monkeypatch: pytest.MonkeyPatch) -> None:
monkeypatch.setenv("no_proxy", "localhost\n127.0.0.1\n")
monkeypatch.delenv("NO_PROXY", raising=False)
client = DefaultAsyncHttpxClient()
assert client is not None

@pytest.mark.filterwarnings("ignore:.*deprecated.*:DeprecationWarning")
async def test_default_client_creation(self) -> None:
# Ensure that the client can be initialized without any exceptions
Expand Down