{"record":{"id":"4c50420238f04d6e","repo":"conductor-oss/conductor","slug":"api-spec-headers-must-not-contain-cr-or-lf-charact","errorCode":null,"errorMessage":"API spec headers must not contain CR or LF characters","messagePattern":"API spec headers must not contain CR or LF characters","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java","lineNumber":284,"sourceCode":"            }\n            currentUrl = target;\n        }\n        throw new IllegalArgumentException(\"API spec exceeded the redirect limit\");\n    }\n\n    private void addHeaders(HttpRequest.Builder builder, Map<String, String> headers) {\n        if (headers == null) {\n            return;\n        }\n        headers.forEach(\n                (name, value) -> {\n                    if (name == null\n                            || value == null\n                            || name.indexOf('\\r') >= 0\n                            || name.indexOf('\\n') >= 0\n                            || value.indexOf('\\r') >= 0\n                            || value.indexOf('\\n') >= 0) {\n                        throw new IllegalArgumentException(\n                                \"API spec headers must not contain CR or LF characters\");\n                    }\n                    builder.header(name, value);\n                });\n    }\n\n    private boolean hasSensitiveHeaders(Map<String, String> headers) {\n        if (headers == null) {\n            return false;\n        }\n        return headers.keySet().stream()\n                .anyMatch(\n                        name ->\n                                \"authorization\".equalsIgnoreCase(name)\n                                        || \"cookie\".equalsIgnoreCase(name)\n                                        || \"proxy-authorization\".equalsIgnoreCase(name));\n    }\n","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/conductor-oss/conductor/blob/cf7c3e4a8adfb158be778ab1ec525323c363cd3a/agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java#L266-L302","documentation":"Error \"API spec headers must not contain CR or LF characters\" thrown in conductor-oss/conductor.","triggerScenarios":"Thrown at agentspan/src/main/java/org/conductoross/conductor/ai/agentspan/runtime/service/ListApiToolsTask.java:284 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove CR/LF characters from the configured API spec header values; they are rejected to prevent header injection."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"cf7c3e4a8adfb158be778ab1ec525323c363cd3a","analyzedAt":"2026-08-14T03:33:19.897Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}