{"record":{"id":"b8fdfbf56d7ed3b5","repo":"larksuite/cli","slug":"inline-image-extension-q-is-not-allowed-supporte","errorCode":null,"errorMessage":"inline image extension %q is not allowed; supported formats: jpg, jpeg, png, gif, webp","messagePattern":"inline image extension %q is not allowed; supported formats: jpg, jpeg, png, gif, webp","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shortcuts/mail/filecheck/filecheck.go","lineNumber":159,"sourceCode":"\n// allowedInlineMIMETypes is the whitelist of MIME types allowed for inline\n// images, checked via content sniffing (http.DetectContentType).\nvar allowedInlineMIMETypes = map[string]struct{}{\n\t\"image/jpeg\": {},\n\t\"image/png\":  {},\n\t\"image/gif\":  {},\n\t\"image/webp\": {},\n}\n\n// CheckInlineImageFormat validates that the file is an allowed inline image\n// format by checking both extension and content-sniffed MIME type.\n// Both must match the whitelist to prevent extension spoofing and MIME forgery.\n// On success it returns the detected MIME type; callers MUST use this as the\n// final Content-Type instead of trusting any user-supplied or inherited value.\nfunc CheckInlineImageFormat(filename string, content []byte) (string, error) {\n\text := strings.ToLower(strings.TrimPrefix(filepath.Ext(filename), \".\"))\n\tif _, ok := allowedInlineExtensions[ext]; !ok {\n\t\treturn \"\", fmt.Errorf(\"inline image extension %q is not allowed; supported formats: jpg, jpeg, png, gif, webp\", ext) //nolint:forbidigo // intermediate mail file-format check; mail command layer wraps into typed ValidationError.\n\t}\n\tdetected := http.DetectContentType(content)\n\t// DetectContentType may return params (e.g. \"text/plain; charset=utf-8\"),\n\t// strip to the base media type.\n\tif i := strings.IndexByte(detected, ';'); i != -1 {\n\t\tdetected = strings.TrimSpace(detected[:i])\n\t}\n\tif _, ok := allowedInlineMIMETypes[detected]; !ok {\n\t\treturn \"\", fmt.Errorf(\"inline image content type %q does not match an allowed image format; supported: image/jpeg, image/png, image/gif, image/webp\", detected) //nolint:forbidigo // intermediate mail file-format check; mail command layer wraps into typed ValidationError.\n\t}\n\treturn detected, nil\n}\n","sourceCodeStart":141,"sourceCodeEnd":172,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/shortcuts/mail/filecheck/filecheck.go#L141-L172","documentation":"CheckInlineImageFormat only permits whitelisted image extensions (jpg, jpeg, png, gif, webp) for inline images, to prevent extension spoofing and MIME forgery; the extension must match the whitelist and the content must then pass content sniffing. This error is returned when the filename's extension is not on the whitelist. Wrapped into a typed ValidationError by the mail command layer.","triggerScenarios":"Calling AddFileInline (or loadAndAttachInline / replaceInline / embedTemplateInlineAttachments) with a filename whose lowercased extension is not one of jpg, jpeg, png, gif, webp — e.g. .svg, .bmp, .tiff, .heic, or a file with no extension.","commonSituations":"Inlining SVG logos or HEIC photos from phones; BMP screenshots; template image paths pointing at non-image files or extensionless files; designers providing TIFF assets.","solutions":["Convert the image to a supported format (PNG or JPEG) before inlining.","For vector graphics like SVG, rasterize to PNG or attach as a regular file/link instead of inlining.","Rename files without an extension to include the correct supported extension (only if the content truly is that image type).","Prefer PNG for graphics/screenshots and JPEG for photos to stay clearly within the whitelist."],"exampleFix":"// before\nb.AddFileInline(\"logo.svg\", \"image/svg+xml\") // not in whitelist\n// after\n// convert logo.svg -> logo.png first\nb.AddFileInline(\"logo.png\", \"image/png\")","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"jpg\": true, \"jpeg\": true, \"png\": true, \"gif\": true, \"webp\": true}\next := strings.ToLower(strings.TrimPrefix(filepath.Ext(name), \".\"))\nif !allowed[ext] {\n    return fmt.Errorf(\"convert %s to jpg/png/gif/webp before inlining\", name)\n}","typeGuard":null,"tryCatchPattern":"mime, err := filecheck.CheckInlineImageFormat(name, data)\nif err != nil {\n    var verr *ValidationError\n    if errors.As(err, &verr) {\n        return fmt.Errorf(\"inline image %s unsupported: %w\", name, verr)\n    }\n    return err\n}\n// use returned mime as the final Content-Type","preventionTips":["Normalize image assets to jpg/png/gif/webp in your asset pipeline before inlining.","Always use the MIME type returned by CheckInlineImageFormat instead of a caller-supplied one.","Treat SVG/HEIC/TIFF as non-inline formats and attach or link them instead.","Validate template image paths to point only at whitelisted image files."],"tags":["email","inline-images","file-validation","whitelist"],"backgroundTag":"blocked-file-extension","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}