From 430ee2dbb8b2bc414940bfbd20784bca70acf1c1 Mon Sep 17 00:00:00 2001
From: Liang-Ting Jiang <lt@openai.com>
Date: Fri, 24 Apr 2026 17:08:37 -0700
Subject: [PATCH] Require absolute file download URLs

---
 codex-rs/codex-api/src/files.rs | 35 ++++-----------------------------
 1 file changed, 4 insertions(+), 31 deletions(-)

diff --git a/codex-rs/codex-api/src/files.rs b/codex-rs/codex-api/src/files.rs
index 9be63fdb90..23f882a4be 100644
--- a/codex-rs/codex-api/src/files.rs
+++ b/codex-rs/codex-api/src/files.rs
@@ -128,7 +128,10 @@ pub async fn download_openai_file(
     auth: &impl AuthProvider,
     download_url: &str,
 ) -> Result<Vec<u8>, OpenAiFileError> {
-    let resolved_url = resolve_openai_file_download_url(base_url, download_url)?;
+    let resolved_url = Url::parse(download_url).map_err(|source| OpenAiFileError::InvalidUrl {
+        url: download_url.to_string(),
+        source,
+    })?;
     let request_builder = if should_attach_auth_to_openai_file_url(&resolved_url, base_url) {
         authorized_request(auth, reqwest::Method::GET, resolved_url.as_str())
     } else {
@@ -458,36 +461,6 @@ async fn response_bytes(
     Ok(bytes.to_vec())
 }
 
-fn resolve_openai_file_download_url(
-    base_url: &str,
-    download_url: &str,
-) -> Result<Url, OpenAiFileError> {
-    match Url::parse(download_url) {
-        Ok(url) => Ok(url),
-        Err(url::ParseError::RelativeUrlWithoutBase) => {
-            let normalized_base_url = if base_url.ends_with('/') {
-                base_url.to_string()
-            } else {
-                format!("{base_url}/")
-            };
-            let base =
-                Url::parse(&normalized_base_url).map_err(|source| OpenAiFileError::InvalidUrl {
-                    url: normalized_base_url.clone(),
-                    source,
-                })?;
-            base.join(download_url)
-                .map_err(|source| OpenAiFileError::InvalidUrl {
-                    url: download_url.to_string(),
-                    source,
-                })
-        }
-        Err(source) => Err(OpenAiFileError::InvalidUrl {
-            url: download_url.to_string(),
-            source,
-        }),
-    }
-}
-
 fn should_attach_auth_to_openai_file_url(download_url: &Url, base_url: &str) -> bool {
     let Ok(base_url) = Url::parse(base_url) else {
         return false;