John Kennedy 6335968237 fix(deepseek): use proper URL parsing for azure endpoint detection (#35455) ...

## Summary

- Fixes [CodeQL alert
#43](https://github.com/langchain-ai/langchain/security/code-scanning/43)
(CWE-20: incomplete URL substring sanitization)
- Replaces `"azure.com" in url` substring check with `urlparse`-based
hostname validation to prevent bypass via crafted URLs (e.g.,
`https://evil-azure.com`, `https://example.com/azure.com`)
- Adds bypass-attempt test cases to the existing Azure endpoint
detection tests

## Why

The substring check `"azure.com" in url` matches URLs where `azure.com`
appears anywhere in the string, not just in the hostname. An
attacker-controlled endpoint like `https://evil-azure.com` or
`https://example.com/azure.com` would incorrectly trigger the Azure code
path. Using `urlparse` to extract and validate the hostname is the
standard fix per CodeQL guidance.

## Test plan

- [x] Existing Azure endpoint detection tests pass
- [x] New negative test cases for bypass attempts pass
- [x] `uv run pytest tests/unit_tests/test_chat_models.py -k azure` —
6/6 passing

> [!NOTE]
> This PR was authored with assistance from an AI agent (Claude Code).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-01 12:14:48 -05:00

..

integration_tests

fix(deepseek): inject model_provider in response_metadata (#33544)

2025-10-17 11:47:59 -04:00

unit_tests

fix(deepseek): use proper URL parsing for azure endpoint detection (#35455)

2026-03-01 12:14:48 -05:00

__init__.py

chore: drop UP045 (#33362)

2025-10-08 21:17:53 -04:00