{"record":{"id":"d2eb4a2d49a210ac","repo":"larksuite/cli","slug":"s-contains-invalid-line-break-characters","errorCode":null,"errorMessage":"%s contains invalid line break characters","messagePattern":"(.+?) contains invalid line break characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/validate/input.go","lineNumber":27,"sourceCode":"\n\t\"github.com/larksuite/cli/internal/charcheck\"\n)\n\n// RejectControlChars rejects C0 control characters (except \\t and \\n) and\n// dangerous Unicode characters from user input.\n//\n// Delegates to charcheck.RejectControlChars — the single source of truth\n// for character-level security checks.\nfunc RejectControlChars(value, flagName string) error {\n\treturn charcheck.RejectControlChars(value, flagName)\n}\n\n// RejectCRLF rejects strings containing carriage return (\\r) or line feed (\\n).\n// These characters enable MIME/HTTP header injection and must never appear in\n// header field names, values, Content-ID, or filename parameters.\nfunc RejectCRLF(value, fieldName string) error {\n\tif strings.ContainsAny(value, \"\\r\\n\") {\n\t\treturn fmt.Errorf(\"%s contains invalid line break characters\", fieldName)\n\t}\n\treturn nil\n}\n","sourceCodeStart":9,"sourceCodeEnd":31,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/validate/input.go#L9-L31","documentation":"RejectCRLF validates that a caller-supplied string contains no carriage return (\\r) or line feed (\\n) characters. CRLF in fields like header names/values or MIME boundaries enables header-injection attacks, so this validator fails fast. The fieldName argument is interpolated into the message so the user knows which field was rejected.","triggerScenarios":"Any call to validate.RejectCRLF with a string containing \\r or \\n, e.g. user input passed via flags into header names/values, MIME part construction (newInlinePart), inline replacement (replaceInline), or validateCID.","commonSituations":"Pasting multi-line content into a single-value flag, shell scripts with accidental newlines from command substitution, data read from files without trimming the trailing newline, or crafted input attempting header injection.","solutions":["Strip CR/LF from the input before passing it (strings.ReplaceAll / strings.TrimSpace).","If multi-line content is intended, pass it through a field that supports it (e.g. file upload or body content) rather than a single-line header-like field.","Quote shell variables and avoid untrimmed $(...) substitutions when populating the flag.","Encode the content (e.g. base64) if a transport requires single-line values."],"exampleFix":"// before\nlark-cli im message create --subject \"$SUBJECT\"\n// after\nSUBJECT=$(printf '%s' \"$SUBJECT\" | tr -d '\\r\\n')\nlark-cli im message create --subject \"$SUBJECT\"","handlingStrategy":"validation","validationCode":"if strings.ContainsAny(value, \"\\r\\n\") {\n    return fmt.Errorf(\"%s must not contain line breaks\", flagName)\n}","typeGuard":null,"tryCatchPattern":"if err := validate.RejectCRLF(subject, \"--subject\"); err != nil {\n    return fmt.Errorf(\"fix --subject: %w\", err)\n}","preventionTips":["Trim and strip CR/LF from any single-line field before passing it to the CLI.","Quote shell variables; avoid raw $(...) expansion into single-line flags.","Prefer file/body parameters for multi-line content.","Add RejectCRLF to your own form/API boundary before values reach header-like fields."],"tags":["input-validation","security","header-injection","crlf"],"backgroundTag":"crlf-injection","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}