{"record":{"id":"8b34a503c0be3e4f","repo":"larksuite/cli","slug":"set-header-header-value-must-not-contain-cr-or-lf","errorCode":null,"errorMessage":"set_header: header value must not contain CR or LF","messagePattern":"set_header: header value must not contain CR or LF","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shortcuts/mail/draft/model.go","lineNumber":308,"sourceCode":"\t\t}\n\tcase \"clear_reply_to\":\n\tcase \"set_body\", \"set_reply_body\":\n\tcase \"replace_body\", \"append_body\":\n\t\tif !isBodyKind(op.BodyKind) {\n\t\t\treturn fmt.Errorf(\"body_kind must be text/plain or text/html\")\n\t\t}\n\t\tif op.Selector != \"\" && op.Selector != \"primary\" {\n\t\t\treturn fmt.Errorf(\"selector must be primary\")\n\t\t}\n\tcase \"set_header\":\n\t\tif strings.TrimSpace(op.Name) == \"\" {\n\t\t\treturn fmt.Errorf(\"set_header requires name\")\n\t\t}\n\t\tif strings.ContainsAny(op.Name, \":\\r\\n\") {\n\t\t\treturn fmt.Errorf(\"set_header: header name must not contain ':', CR, or LF\")\n\t\t}\n\t\tif strings.ContainsAny(op.Value, \"\\r\\n\") {\n\t\t\treturn fmt.Errorf(\"set_header: header value must not contain CR or LF\")\n\t\t}\n\tcase \"remove_header\":\n\t\tif strings.TrimSpace(op.Name) == \"\" {\n\t\t\treturn fmt.Errorf(\"remove_header requires name\")\n\t\t}\n\tcase \"add_attachment\":\n\t\tif strings.TrimSpace(op.Path) == \"\" {\n\t\t\treturn fmt.Errorf(\"add_attachment requires path\")\n\t\t}\n\tcase \"remove_attachment\":\n\t\tif !op.Target.hasAnyKey() {\n\t\t\treturn fmt.Errorf(\"remove_attachment requires target with at least one of part_id, cid, or token\")\n\t\t}\n\tcase \"add_inline\":\n\t\tif strings.TrimSpace(op.Path) == \"\" {\n\t\t\treturn fmt.Errorf(\"add_inline requires path\")\n\t\t}\n\t\tif strings.TrimSpace(op.CID) == \"\" {","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/shortcuts/mail/draft/model.go#L290-L326","documentation":"Thrown by PatchOp.Validate() in shortcuts/mail/draft/model.go:308 when a set_header op's Value contains a carriage return or line feed. A value with CRLF would terminate the header line early and inject additional headers, so it is rejected client-side. Newlines inside header values are never valid here.","triggerScenarios":"value containing \"\\n\" or \"\\r\\n\", e.g. a multi-line value, a value read from a file without trimming the trailing newline, or untrusted input containing \"\\r\\nBcc: attacker@x.com\".","commonSituations":"Reading header values from files, environment variables, or stdin where a trailing newline remains; multi-line text pasted into a header value; deliberate CRLF injection attempts from user-supplied data.","solutions":["Strip newlines: strings.TrimSpace(value) for trailing whitespace, or strings.ReplaceAll(value, \"\\n\", \" \") to flatten multi-line values.","Reject the input upstream if a newline-containing value indicates tampering.","If you need multiple headers, emit multiple set_header ops instead of one newline-joined value."],"exampleFix":"// before\nPatchOp{Op: \"set_header\", Name: \"X-Note\", Value: strings.TrimSpace(fileContent)}\n// fileContent may still contain internal \\n\n\n// after\nv := strings.ReplaceAll(fileContent, \"\\r\", \"\")\nv = strings.ReplaceAll(v, \"\\n\", \" \")\nPatchOp{Op: \"set_header\", Name: \"X-Note\", Value: v}","handlingStrategy":"validation","validationCode":"if strings.ContainsAny(value, \"\\r\\n\") {\n    return fmt.Errorf(\"header value must not contain newlines\")\n}","typeGuard":"func safeHeaderValue(v string) bool {\n    return !strings.ContainsAny(v, \"\\r\\n\")\n}","tryCatchPattern":null,"preventionTips":["Trim trailing newlines when reading values from files/env/stdin.","Flatten multi-line values by replacing \\r and \\n with spaces before setting.","Emit multiple set_header ops instead of newline-joined values; reject newline-bearing untrusted input as injection."],"tags":["mail","validation","patch-op","headers","security"],"backgroundTag":"header-injection","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}