glm-5.3-flash
164a9d7543
- percent-encode path-parameter values with a WHATWG path-segment superset (/, %, ?, #, \\, controls): traversal values, query/fragment structure, and later-placeholder strings can no longer alter the request line (FWD-01) - single-pass template rendering; rendered values are never re-substituted; unbound or unterminated placeholders error loudly - append the request path to the base URL directory (https://host/v1 + /chat/completions keeps /v1) instead of Url::join semantics, with a post-assembly origin-equality check (FWD-02) - base_url validation: https/http-only scheme allowlist, explicit host required, userinfo rejected (credentials flow via Capabilities only); request_path is never empty Verification: cargo test (238 lib tests incl. 8 new FWD-01/02 tests), cargo clippy --all-targets -- -D warnings, cargo fmt --check