{"record":{"id":"976811fce4b771a6","repo":"apple/pkl","slug":"invalidhttpheadervalue","errorCode":"invalidHttpHeaderValue","errorMessage":"HTTP header value `{0}` has invalid syntax.","messagePattern":"HTTP header value `(.+?)` has invalid syntax\\.","errorType":"error_code","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/util/IoUtils.java","lineNumber":949,"sourceCode":"  public static void validateHeaderName(String headerName) {\n    if (isReservedHeaderName(headerName)) {\n      throw new IllegalArgumentException(\n          ErrorMessages.create(\"invalidHttpHeaderReserved\", headerName));\n    }\n\n    if (hasReservedHeaderPrefix(headerName)) {\n      throw new IllegalArgumentException(\n          ErrorMessages.create(\"invalidHttpHeaderReservedPrefix\", headerName));\n    }\n\n    if (!headerNameLike.matcher(headerName).matches()) {\n      throw new IllegalArgumentException(ErrorMessages.create(\"invalidHttpHeaderName\", headerName));\n    }\n  }\n\n  public static void validateHeaderValue(String headerValue) {\n    if (!headerValueLike.matcher(headerValue).matches()) {\n      throw new IllegalArgumentException(\n          ErrorMessages.create(\"invalidHttpHeaderValue\", headerValue));\n    }\n    if (headerValue.length() > 4096) {\n      throw new IllegalArgumentException(\n          ErrorMessages.create(\"invalidHttpHeaderValueTooLong\", headerValue));\n    }\n  }\n\n  private static @Nullable String getFilenameExtension(String fileName) {\n    var dotIndex = fileName.lastIndexOf('.');\n    // 0 if hidden file (e.g. `.gitignore`); not an extension\n    if (dotIndex == -1 || dotIndex == 0) {\n      return null;\n    }\n    return fileName.substring(dotIndex + 1);\n  }\n\n  public static @Nullable Path findExecutableOnPath(String executable) {","sourceCodeStart":931,"sourceCodeEnd":967,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/util/IoUtils.java#L931-L967","documentation":"The HTTP header value failed Pkl's value syntax check (headerValueLike regex), which permits only valid visible characters per RFC 7230 field-value rules (no control characters like newlines, NUL, or non-ASCII bytes outside the accepted set). Thrown from IoUtils.validateHeaderValue.","triggerScenarios":"Passing a header value containing newlines, tabs in invalid positions, control characters, or non-Latin-1 characters to validateHeaderValue / external HTTP header config, e.g. a multi-line value or a value pasted with a trailing \\n.","commonSituations":"Values interpolated from secrets or environment variables that carry trailing newlines; pasted API keys with hidden control characters; building headers from raw user input.","solutions":["Trim the value and strip control characters/newlines before configuring it.","Re-encode the value (e.g. Base64-encode binary/unicode data) so it consists of allowed characters.","Escape or normalize the source (env var, secret manager) that introduces the illegal characters."],"exampleFix":"// before\n[\"X-Trace\"] = \"abc\\n123\"\n// after\n[\"X-Trace\"] = \"abc123\"","handlingStrategy":"validation","validationCode":"if (value == null || value.chars().anyMatch(c -> c < 32 && c != '\\t') || value.chars().anyMatch(c -> c > 126 && c < 160)) throw new IllegalArgumentException(\"bad header value\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Trim values sourced from env vars and secret managers (trailing newlines are common).","Base64-encode binary or non-ASCII payloads before putting them in headers.","Never interpolate raw multi-line content into header values."],"tags":["http","validation","syntax"],"backgroundTag":"invalid-argument-value","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}