{"record":{"id":"27a96c9042ca41ae","repo":"larksuite/cli","slug":"emlbuilder-header-value-contains-dangerous-unicod","errorCode":null,"errorMessage":"emlbuilder: header value contains dangerous Unicode character: %q","messagePattern":"emlbuilder: header value contains dangerous Unicode character: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shortcuts/mail/emlbuilder/builder.go","lineNumber":143,"sourceCode":"\tisOtherPart bool   // true = no Content-Disposition (AddOtherPart); false = Content-Disposition: inline\n}\n\n// New returns an empty Builder.\nfunc New() Builder {\n\treturn Builder{}\n}\n\n// validateHeaderValue rejects strings that contain characters unsafe in MIME\n// header values: C0 control chars (except \\t for folded headers), DEL (0x7F),\n// and dangerous Unicode (Bidi overrides, zero-width chars) that enable\n// visual-spoofing attacks.\nfunc validateHeaderValue(v string) error {\n\tfor _, r := range v {\n\t\tif r != '\\t' && (r < 0x20 || r == 0x7f) {\n\t\t\treturn fmt.Errorf(\"emlbuilder: header value contains control character: %q\", v) //nolint:forbidigo // intermediate EML builder error; mail command layer wraps into typed ValidationError.\n\t\t}\n\t\tif isHeaderDangerousUnicode(r) {\n\t\t\treturn fmt.Errorf(\"emlbuilder: header value contains dangerous Unicode character: %q\", v) //nolint:forbidigo // intermediate EML builder error; mail command layer wraps into typed ValidationError.\n\t\t}\n\t}\n\treturn nil\n}\n\n// isHeaderDangerousUnicode identifies Unicode code points used for visual\n// spoofing: Bidi overrides that reverse display order, and zero-width characters\n// that hide content.  These must not appear in email header values.\nfunc isHeaderDangerousUnicode(r rune) bool {\n\tswitch {\n\tcase r >= 0x200B && r <= 0x200D: // zero-width space/non-joiner/joiner\n\t\treturn true\n\tcase r == 0xFEFF: // BOM / zero-width no-break space\n\t\treturn true\n\tcase r >= 0x202A && r <= 0x202E: // Bidi: LRE/RLE/PDF/LRO/RLO\n\t\treturn true\n\tcase r >= 0x2028 && r <= 0x2029: // line/paragraph separator\n\t\treturn true","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/shortcuts/mail/emlbuilder/builder.go#L125-L161","documentation":"The EML builder rejected a header value because it contains a Unicode code point deemed dangerous for RFC 5322 headers (e.g. bidirectional-override or zero-width characters used in spoofing). validateHeaderValue scans every rune of the value and fails fast so a hostile or copy-pasted header can never reach the serialized .eml output. The mail command layer wraps this into a typed ValidationError.","triggerScenarios":"Calling Subject, MessageID, InReplyTo, References, DispositionNotificationTo, or LMSReplyToMessageID with a string containing a dangerous Unicode rune (checked by isHeaderDangerousUnicode), e.g. U+202E RIGHT-TO-LEFT OVERRIDE or zero-width characters.","commonSituations":"Pasting a subject copied from a chat or document that contains invisible/zero-width characters; building localized subjects with RTL overrides for Arabic/Hebrew text; user-supplied subject text from a web form containing spoofing characters.","solutions":["Inspect the header value and remove dangerous Unicode characters (RTL overrides U+202A-U+202E, zero-width U+200B-U+200F, etc.).","Sanitize user-supplied header text before passing it to the builder, stripping or replacing dangerous code points.","If RTL display is genuinely needed, use explicit language/HTML body formatting instead of Unicode control characters in the header value."],"exampleFix":"// before\nb.Subject(\"‮lname@bank.com‬ payment\")\n// after\nb.Subject(\"payment reminder\") // dangerous bidi-override characters removed","handlingStrategy":"validation","validationCode":"var dangerousUnicode = regexp.MustCompile(`[\\x{202A}-\\x{202E}\\x{2066}-\\x{2069}\\x{200B}-\\x{200F}\\x{FEFF}]`)\nfunc safeHeaderValue(v string) bool { return !dangerousUnicode.MatchString(v) }\n// call before b.Subject(v) / b.MessageID(v) etc.","typeGuard":null,"tryCatchPattern":"var raw []byte\nerr := b.Subject(userSubject)\nif err != nil {\n    var verr *ValidationError\n    if errors.As(err, &verr) {\n        return fmt.Errorf(\"subject rejected: %w\", verr)\n    }\n    return err\n}","preventionTips":["Sanitize all user-supplied header text with a Unicode control/bidi stripper before passing to the builder.","Never copy-paste subject text from rich-text sources without normalizing (e.g. golang.org/x/text/unicode/norm plus explicit bidi removal).","Add a unit test asserting your subject templates contain no bidi/zero-width code points."],"tags":["email","header-validation","unicode","eml"],"backgroundTag":"header-injection-unicode","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}