From 250ea5e849103f6f7b70193c8d3a3ad02b7e8bc6 Mon Sep 17 00:00:00 2001 From: backryun Date: Sat, 8 Aug 2026 08:54:03 +0900 Subject: [PATCH] fix(types): validate Azure OpenAI base URLs (#9563) Merge-train validated (tip 6ce4effef8). Vitest failures confirmed as base-red (#9679). --- open-sse/executors/azure-openai.ts | 6 +++++- tests/unit/azure-openai-executor.test.ts | 16 ++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/open-sse/executors/azure-openai.ts b/open-sse/executors/azure-openai.ts index 812733ce31..9b910d5c95 100644 --- a/open-sse/executors/azure-openai.ts +++ b/open-sse/executors/azure-openai.ts @@ -28,7 +28,11 @@ export class AzureOpenAIExecutor extends DefaultExecutor { void urlIndex; const providerSpecificData = credentials?.providerSpecificData || {}; - const baseUrl = normalizeAzureBaseUrl(providerSpecificData.baseUrl || this.config.baseUrl); + const baseUrl = normalizeAzureBaseUrl( + typeof providerSpecificData.baseUrl === "string" + ? providerSpecificData.baseUrl + : this.config.baseUrl + ); const apiVersion = typeof providerSpecificData.apiVersion === "string" && providerSpecificData.apiVersion.trim() ? providerSpecificData.apiVersion.trim() diff --git a/tests/unit/azure-openai-executor.test.ts b/tests/unit/azure-openai-executor.test.ts index c8b47021ee..0df0d98c42 100644 --- a/tests/unit/azure-openai-executor.test.ts +++ b/tests/unit/azure-openai-executor.test.ts @@ -32,6 +32,22 @@ test("AzureOpenAIExecutor strips duplicated /openai suffixes from configured bas ); }); +test("AzureOpenAIExecutor ignores non-string credential base URLs", () => { + const executor = new AzureOpenAIExecutor(); + executor.config.baseUrl = "https://fallback-resource.openai.azure.com"; + + const url = executor.buildUrl("deploy-1", false, 0, { + providerSpecificData: { + baseUrl: { host: "untrusted.example.com" }, + }, + }); + + assert.equal( + url, + "https://fallback-resource.openai.azure.com/openai/deployments/deploy-1/chat/completions?api-version=2024-12-01-preview" + ); +}); + test("AzureOpenAIExecutor uses api-key auth headers instead of Bearer auth", () => { const executor = new AzureOpenAIExecutor(); const headers = executor.buildHeaders({ apiKey: "azure-key-123" }, true);