fix: harden LLM endpoint URL parsing

Author: TimInTech

app/config.py

@@ -12,6 +12,7 @@
 import logging
 import os
 import re
+import unicodedata
 from pathlib import Path
 from typing import Any
 from urllib.parse import urlsplit
@@ -550,7 +551,7 @@ def _normalize_base_url(value: Any) -> str:
     candidate = value.strip()
     if not candidate:
         return ""
-    if any(char.isspace() or ord(char) < 32 for char in candidate):
+    if any(char.isspace() or unicodedata.category(char) in {"Cc", "Cf"} for char in candidate):
         raise ValueError("LLM base URL must not contain whitespace or control characters")
 
     try:
@@ -595,9 +596,13 @@ def _normalize_base_url(value: Any) -> str:
 
 def _looks_like_alternate_numeric_ipv4(hostname: str) -> bool:
     parts = hostname.split(".")
-    return bool(parts) and all(NUMERIC_HOST_PART_RE.fullmatch(part) for part in parts) and not (
-        len(parts) == 4 and all(part.isdecimal() for part in parts)
-    )
+    if not parts or not all(NUMERIC_HOST_PART_RE.fullmatch(part) for part in parts):
+        return False
+    try:
+        address = ipaddress.IPv4Address(hostname)
+    except ValueError:
+        return True
+    return str(address) != hostname
 
 
 def _normalize_model(value: Any) -> str:

tests/test_config.py

@@ -236,12 +236,35 @@ def test_direct_setter_accepts_https_and_explicit_local_http_ranges(self, config
             "http://local\nhost/v1",
             "https://user:password@example.com/v1",
             "https://example.com:99999/v1",
+            "https://0177.0.0.1/v1",
+            "https://127.000.000.001/v1",
+            "https://999.1.1.1/v1",
+            "https://api.example.com/\x7f",
+            "https://api.example.com/\u0080",
         ],
     )
     def test_direct_setter_rejects_unsafe_or_malformed_urls(self, config, value):
         with pytest.raises(ValueError, match="LLM base URL"):
             config.llm_base_url = value
 
+    @pytest.mark.parametrize(
+        "unsafe_url",
+        [
+            "https://0177.0.0.1/v1",
+            "https://999.1.1.1/v1",
+        ],
+    )
+    def test_stored_noncanonical_numeric_https_url_is_cleared(self, config_dir, unsafe_url):
+        config_dir.mkdir(parents=True, exist_ok=True)
+        (config_dir / "config.json").write_text(
+            json.dumps({"llm_base_url": unsafe_url}), encoding="utf-8"
+        )
+
+        loaded = BlitztextConfig(config_dir=config_dir)
+
+        assert loaded.llm_base_url == ""
+        assert loaded.has_unsafe_llm_base_url is True
+
     def test_legacy_public_http_url_is_cleared_and_warned_without_echoing_url(self, config_dir, caplog):
         config_dir.mkdir(parents=True, exist_ok=True)
         unsafe_url = "http://api.example.com/v1"

tests/test_settings_dialog.py

@@ -205,6 +205,29 @@ def test_save_settings_rejects_public_http_base_url_without_saving_or_accepting(
     assert not fake.config.config_file.exists()
 
 
+@pytest.mark.parametrize(
+    "unsafe_url",
+    [
+        "https://0177.0.0.1/v1",
+        "https://999.1.1.1/v1",
+        "https://api.example.com/\x7f",
+        "https://api.example.com/\u0080",
+    ],
+)
+def test_save_settings_rejects_invalid_https_url_without_saving_or_accepting(tmp_path, unsafe_url):
+    config_dir = tmp_path / ".config" / "blitztext-linux"
+    fake = _fake_save_self(config_dir, "standard")
+    fake.edit_base_url = _Edit(unsafe_url)
+    fake.accept = Mock()
+
+    with patch("app.blitztext_linux.QMessageBox") as message_box:
+        SettingsDialog.save_settings(fake)
+
+    message_box.critical.assert_called_once()
+    fake.accept.assert_not_called()
+    assert not fake.config.config_file.exists()
+
+
 def test_save_settings_persists_and_applies_ui_language(tmp_path):
     config_dir = tmp_path / ".config" / "blitztext-linux"
     fake = _fake_save_self(config_dir, "standard", ui_language="en")