{"record":{"id":"8968d24c22d73a7f","repo":"HKUDS/Vibe-Trading","slug":"source-produces-an-invalid-multiline-http-header","errorCode":null,"errorMessage":"{source} produces an invalid multiline HTTP header ({name!r}).","messagePattern":"(.+?) produces an invalid multiline HTTP header \\((.+?)\\)\\.","errorType":"validation","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"agent/src/providers/llm.py","lineNumber":778,"sourceCode":"        )\n    if any(ord(char) < 33 or ord(char) > 126 for char in value):\n        raise RuntimeError(\n            f\"{source} contains whitespace or control characters and cannot be \"\n            \"sent in an HTTP Authorization header. Replace it with the raw \"\n            \"provider API key.\"\n        )\n\n\ndef _validate_explicit_headers(headers: Mapping[str, str], *, source: str) -> None:\n    \"\"\"Reject explicit provider headers that HTTPX cannot encode safely.\"\"\"\n    for name, value in headers.items():\n        if not name.isascii() or not value.isascii():\n            raise RuntimeError(\n                f\"{source} produces a non-ASCII HTTP header ({name!r}). \"\n                \"Use an ASCII-only header value.\"\n            )\n        if \"\\r\" in value or \"\\n\" in value:\n            raise RuntimeError(\n                f\"{source} produces an invalid multiline HTTP header ({name!r}).\"\n            )\n\n\ndef _redact_proxy_url(name: str, raw: str | None) -> str:\n    \"\"\"Return a credential-free proxy URL label.\"\"\"\n    if not raw:\n        return \"unset\"\n    if name.upper().endswith(\"NO_PROXY\"):\n        return \"set\"\n    return _redact_base_url_for_log(raw)\n\n\ndef _deepseek_adapter_mode() -> str:\n    \"\"\"Return the configured DeepSeek adapter mode.\"\"\"\n    mode = get_env_config().llm.vibe_trading_deepseek_adapter.strip().lower()\n    aliases = {\n        \"compat\": \"openai-compatible\",","sourceCodeStart":760,"sourceCodeEnd":796,"githubUrl":"https://github.com/HKUDS/Vibe-Trading/blob/80ffdda44c5c4db0dd84d70e051cca591cea67df/agent/src/providers/llm.py#L760-L796","documentation":"Raised by _validate_explicit_headers when an explicit header value contains \\r or \\n. Multiline header values enable header injection/smuggling attacks and are rejected by httpcore, so the library blocks them before the request is sent.","triggerScenarios":"Passing an extra header whose value includes a newline, e.g. a formatted API key, a cookie string with line breaks, or an accidentally interpolated multi-line template string.","commonSituations":"Using a triple-quoted string or f-string spanning lines as a header value; pasting keys copied from emails/docs that contain trailing newlines; attempting to smuggle multiple headers as one value.","solutions":["Strip line endings from the value: value.replace('\\r','').replace('\\n','').strip()","Split the intended content into separate header entries, one per header","Audit where the value originates and fix the producer to emit a single-line string"],"exampleFix":"# before\nheaders = {\"Authorization\": f\"Bearer {token}\\n\"}\n\n# after\nheaders = {\"Authorization\": f\"Bearer {token.strip()}\"}","handlingStrategy":"validation","validationCode":"safe = {k: v.replace('\\r', '').replace('\\n', '').strip() for k, v in extra_headers.items()}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip whitespace/newlines from any header sourced from files, env vars, or user input","Lint config files for multi-line strings assigned to header keys"],"tags":["http-headers","header-injection","validation","security"],"backgroundTag":"invalid-http-header","analyzedSha":"80ffdda44c5c4db0dd84d70e051cca591cea67df","analyzedAt":"2026-08-28T12:46:38.989Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}