{"record":{"id":"449461a2f33c7f93","repo":"larksuite/cli","slug":"set-header-header-name-must-not-contain-cr","errorCode":null,"errorMessage":"set_header: header name must not contain ':', CR, or LF","messagePattern":"set_header: header name must not contain ':', CR, or LF","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shortcuts/mail/draft/model.go","lineNumber":305,"sourceCode":"\tcase \"set_reply_to\":\n\t\tif len(op.Addresses) == 0 {\n\t\t\treturn fmt.Errorf(\"set_reply_to requires addresses\")\n\t\t}\n\tcase \"clear_reply_to\":\n\tcase \"set_body\", \"set_reply_body\":\n\tcase \"replace_body\", \"append_body\":\n\t\tif !isBodyKind(op.BodyKind) {\n\t\t\treturn fmt.Errorf(\"body_kind must be text/plain or text/html\")\n\t\t}\n\t\tif op.Selector != \"\" && op.Selector != \"primary\" {\n\t\t\treturn fmt.Errorf(\"selector must be primary\")\n\t\t}\n\tcase \"set_header\":\n\t\tif strings.TrimSpace(op.Name) == \"\" {\n\t\t\treturn fmt.Errorf(\"set_header requires name\")\n\t\t}\n\t\tif strings.ContainsAny(op.Name, \":\\r\\n\") {\n\t\t\treturn fmt.Errorf(\"set_header: header name must not contain ':', CR, or LF\")\n\t\t}\n\t\tif strings.ContainsAny(op.Value, \"\\r\\n\") {\n\t\t\treturn fmt.Errorf(\"set_header: header value must not contain CR or LF\")\n\t\t}\n\tcase \"remove_header\":\n\t\tif strings.TrimSpace(op.Name) == \"\" {\n\t\t\treturn fmt.Errorf(\"remove_header requires name\")\n\t\t}\n\tcase \"add_attachment\":\n\t\tif strings.TrimSpace(op.Path) == \"\" {\n\t\t\treturn fmt.Errorf(\"add_attachment requires path\")\n\t\t}\n\tcase \"remove_attachment\":\n\t\tif !op.Target.hasAnyKey() {\n\t\t\treturn fmt.Errorf(\"remove_attachment requires target with at least one of part_id, cid, or token\")\n\t\t}\n\tcase \"add_inline\":\n\t\tif strings.TrimSpace(op.Path) == \"\" {","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/shortcuts/mail/draft/model.go#L287-L323","documentation":"Thrown by PatchOp.Validate() in shortcuts/mail/draft/model.go:305 when a set_header op's Name contains a colon, carriage return, or line feed. Colons would break the \"Name: Value\" header framing and CRLF enables header injection, so names containing them are rejected before any API call.","triggerScenarios":"name:\"X-Custom: v\" (colon included by mistake), name built by concatenating \"Name:\" + value, or a name containing \"\\r\\n\" from untrusted/user-supplied input attempting header injection.","commonSituations":"Copying a full header line \"X-Foo: bar\" from raw email source and using it as the name; interpolating user input into the name field — a classic header-injection vector; parsing headers where the split on ':' didn't happen.","solutions":["Pass only the header name without the colon; put the value in op.Value.","Sanitize untrusted input: reject or strip any ':', '\\r', '\\n' from the name before building the op.","If the value itself contains newlines, fold it per RFC 5322 or split into multiple headers."],"exampleFix":"// before\nPatchOp{Op: \"set_header\", Name: \"X-Trace-Id: \" + traceID}\n\n// after\nPatchOp{Op: \"set_header\", Name: \"X-Trace-Id\", Value: traceID}","handlingStrategy":"validation","validationCode":"if strings.ContainsAny(name, \":\\r\\n\") {\n    return fmt.Errorf(\"invalid header name %q\", name)\n}","typeGuard":"func safeHeaderName(name string) bool {\n    if name == \"\" { return false }\n    return !strings.ContainsAny(name, \":\\r\\n\")\n}","tryCatchPattern":null,"preventionTips":["Pass the name without the colon — value goes in op.Value.","Treat header names from user input as untrusted: reject ':', CR, LF outright.","When parsing raw header lines, split on the first ':' and keep only the left side as the name."],"tags":["mail","validation","patch-op","headers","security"],"backgroundTag":"header-injection","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}