[szhaomsft]

Defect and impact

The cost calculator and GPT Live browser sample parsed HTTP request targets with new URL(...) outside error handling. Invalid targets could cause an unhandled rejection in the asynchronous request callback, terminating the Node process before routing or token authorization. This is a local service denial of service: both servers bind to loopback by default, not the public Internet.

Fix

• Catch only ERR_INVALID_URL from request-target parsing and return HTTP 400 with a generic, non-cacheable response. Unrelated internal exceptions are not swallowed.
• Preserve existing asset allowlists, percent-encoded path/query behavior, calculator HEAD requests, configuration responses, and Host/Origin checks on token requests.
• Add an actual calculator subprocess regression and extend GPT Live's existing offline HTTP tests. Both send malformed requests, then verify valid requests still succeed; GPT Live also verifies credential access and same-origin authorization.
• Document the behavior and include the calculator server regression in its existing Pages validation job.

This is one root issue across two local servers; no dependency changes or unrelated security fixes are included.

Validation

Reviewed baseline: 89e7e085bafe3754d0fc50a5315d33536af13dd6. Verified the expected origin, clean isolated worktree, and exact HEAD before edits.

Before the fix, the new calculator subprocess test failed with a connection reset and the GPT Live offline regression independently failed with an unhandled ERR_INVALID_URL in the actual HTTP callback.

After the fix, on Windows with Node.js 26.13.0:

• node --test tools\cost_calculator\calculator.test.mjs tools\cost_calculator\server.test.mjs — 27 passed.
• npm --prefix samples\gpt_live\js test — 38 passed (including browser bundle generation and same-origin token guards).
• node --check for both servers and the calculator app — passed.
• git diff --cached --check — passed.

Dependencies were restored from the existing lockfile only after the initial test failed for a missing package, with installation/cache confined to the isolated worktree; the temporary cache was removed. No Azure credentials, .env loading, deployments, or live-service calls were used. Browser/audio interaction and Linux execution were not tested locally. All six open PRs were reviewed, then refreshed before publication; none contained an equivalent malformed-target fix.