fix(vllm): validate compatible base URLs

Author: waleedlatif1

apps/sim/providers/openai-compat/base-url.test.ts

@@ -10,4 +10,13 @@ describe('getOpenAICompatibleApiBaseUrl', () => {
   ])('normalizes %s to %s', (input, expected) => {
     expect(getOpenAICompatibleApiBaseUrl(input)).toBe(expected)
   })
+
+  it.each(['http://localhost:8000?token=value', 'http://localhost:8000#models'])(
+    'rejects unsupported URL components in %s',
+    (input) => {
+      expect(() => getOpenAICompatibleApiBaseUrl(input)).toThrow(
+        'OpenAI-compatible base URL must not include query parameters or a fragment'
+      )
+    }
+  )
 })

apps/sim/providers/openai-compat/base-url.ts

@@ -1,7 +1,15 @@
 /**
  * Normalizes a server root or versioned OpenAI-compatible URL to the `/v1` API base.
+ *
+ * @throws When the URL contains query parameters or a fragment.
  */
 export function getOpenAICompatibleApiBaseUrl(baseUrl: string): string {
-  const normalized = baseUrl.trim().replace(/\/+$/, '')
-  return normalized.endsWith('/v1') ? normalized : `${normalized}/v1`
+  const url = new URL(baseUrl.trim())
+  if (url.search || url.hash) {
+    throw new Error('OpenAI-compatible base URL must not include query parameters or a fragment')
+  }
+
+  const pathname = url.pathname.replace(/\/+$/, '')
+  url.pathname = pathname.endsWith('/v1') ? pathname : `${pathname}/v1`
+  return url.toString()
 }