{"record":{"id":"58d8024d4a4c52d9","repo":"larksuite/cli","slug":"inline-cid-q-contains-invalid-characters-spaces","errorCode":null,"errorMessage":"inline cid %q contains invalid characters (spaces, tabs, angle brackets, or parentheses are not allowed)","messagePattern":"inline cid %q contains invalid characters \\(spaces, tabs, angle brackets, or parentheses are not allowed\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shortcuts/mail/draft/patch.go","lineNumber":861,"sourceCode":"func normalizeCID(cid string) string {\n\tcid = strings.TrimSpace(cid)\n\tif strings.HasPrefix(cid, \"<\") && strings.HasSuffix(cid, \">\") {\n\t\tcid = cid[1 : len(cid)-1]\n\t}\n\treturn cid\n}\n\n// validateCID checks that a Content-ID value is non-empty and free of\n// characters that would break MIME headers or cause ambiguous references.\nfunc validateCID(cid string) error {\n\tif cid == \"\" {\n\t\treturn fmt.Errorf(\"inline cid is empty\")\n\t}\n\tif err := validate.RejectCRLF(cid, \"inline cid\"); err != nil {\n\t\treturn err\n\t}\n\tif strings.ContainsAny(cid, \" \\t<>()\") {\n\t\treturn fmt.Errorf(\"inline cid %q contains invalid characters (spaces, tabs, angle brackets, or parentheses are not allowed)\", cid)\n\t}\n\treturn nil\n}\n\nfunc ensureInlineContainerRef(partRef **Part) (*Part, error) {\n\tif partRef == nil || *partRef == nil {\n\t\treturn nil, fmt.Errorf(\"body container is nil\")\n\t}\n\tpart := *partRef\n\tif strings.EqualFold(part.MediaType, \"multipart/related\") {\n\t\treturn part, nil\n\t}\n\trelated := newMultipartContainer(\"multipart/related\")\n\trelated.Children = []*Part{part}\n\trelated.Dirty = true\n\t*partRef = related\n\treturn related, nil\n}","sourceCodeStart":843,"sourceCodeEnd":879,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/shortcuts/mail/draft/patch.go#L843-L879","documentation":"validateCID rejects Content-IDs containing characters that are illegal or ambiguous in MIME headers and cid references: spaces, tabs, angle brackets, and parentheses. Allowing them could break header parsing or create ambiguous CID references in the HTML body.","triggerScenarios":"Calling inline add/replace with a cid containing a space, tab, '<', '>', '(' or ')' — e.g. passing a raw '<cid:image001@x>' string including brackets, or a filename with spaces used as the cid.","commonSituations":"Reusing the full <...> wrapped cid string from HTML source instead of the bare value; using file names like 'screen shot 1.png' as cids; cids copied with surrounding parentheses from prose.","solutions":["Strip angle brackets and whitespace: use the bare cid like image001@domain","Generate a UUID-based cid via the library's CID generation (see generateCID) which is inherently safe","Sanitize/replace invalid characters in your cid before building the op","Note that CRLF is separately rejected by validate.RejectCRLF; keep cids single-line"],"exampleFix":"// before\ncid := \"<image 001@domain>\"\n// after\ncid := \"image001@domain\"","handlingStrategy":"validation","validationCode":"func cidSafe(cid string) bool {\n\treturn cid != \"\" && !strings.ContainsAny(cid, \" \\t<>()\") && !strings.ContainsAny(cid, \"\\r\\n\")\n}","typeGuard":"func cidSafe(cid string) bool {\n\treturn cid != \"\" && !strings.ContainsAny(cid, \" \\t<>()\") && !strings.ContainsAny(cid, \"\\r\\n\")\n}","tryCatchPattern":"if err := applyOp(snap, op); err != nil && strings.Contains(err.Error(), \"invalid characters\") {\n\t// strip <>/whitespace or regenerate a UUID cid and retry\n}","preventionTips":["Always strip angle brackets and whitespace from cids copied from HTML","Never use filenames (which may contain spaces) directly as cids","Prefer UUID-based cids; they are inherently RFC-safe","Keep cids single-line (no CR/LF)"],"tags":["mail","draft","mime","cid","validation","invalid-characters"],"backgroundTag":"invalid-cid","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}