larksuite/cli · error

inline image content type %q does not match an allowed image

Error message

inline image content type %q does not match an allowed image format; supported: image/jpeg, image/png, image/gif, image/webp

What it means

CheckInlineImageFormat validates that an inline image attached to a mail message has a MIME type on the allowlist (jpeg, png, gif, webp). It detects the actual content type of the file bytes (sniffing, not trusting the extension), strips any parameters, and rejects anything outside the allowlist. This guards the mail compose path against inline image formats the mail backend cannot render.

Source

Thrown at shortcuts/mail/filecheck/filecheck.go:168

// CheckInlineImageFormat validates that the file is an allowed inline image
// format by checking both extension and content-sniffed MIME type.
// Both must match the whitelist to prevent extension spoofing and MIME forgery.
// On success it returns the detected MIME type; callers MUST use this as the
// final Content-Type instead of trusting any user-supplied or inherited value.
func CheckInlineImageFormat(filename string, content []byte) (string, error) {
	ext := strings.ToLower(strings.TrimPrefix(filepath.Ext(filename), "."))
	if _, ok := allowedInlineExtensions[ext]; !ok {
		return "", fmt.Errorf("inline image extension %q is not allowed; supported formats: jpg, jpeg, png, gif, webp", ext) //nolint:forbidigo // intermediate mail file-format check; mail command layer wraps into typed ValidationError.
	}
	detected := http.DetectContentType(content)
	// DetectContentType may return params (e.g. "text/plain; charset=utf-8"),
	// strip to the base media type.
	if i := strings.IndexByte(detected, ';'); i != -1 {
		detected = strings.TrimSpace(detected[:i])
	}
	if _, ok := allowedInlineMIMETypes[detected]; !ok {
		return "", fmt.Errorf("inline image content type %q does not match an allowed image format; supported: image/jpeg, image/png, image/gif, image/webp", detected) //nolint:forbidigo // intermediate mail file-format check; mail command layer wraps into typed ValidationError.
	}
	return detected, nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Convert the image to JPEG, PNG, GIF, or WebP before attaching it inline.
2. If the image is decorative, send it as a regular file attachment instead of an inline/embedded image, if the flow allows non-image types there.
3. Verify the file is actually the format it claims (e.g. `file image.png`); corrupted or mislabeled files can be detected as an unexpected type.

Example fix

// before
attachInline("logo.svg")
// error: inline image content type "image/svg+xml" does not match an allowed image format

// after
// convert first: convert logo.svg -resize 200x logo.png
attachInline("logo.png")

var allowed = map[string]bool{"image/jpeg": true, "image/png": true, "image/gif": true, "image/webp": true}
ct, err := DetectContentType(path) // or http.DetectContentType(bytes)
if err != nil || !allowed[strings.TrimSpace(strings.SplitN(ct, ";", 2)[0])] {
    return fmt.Errorf("skipping inline image %s: unsupported type %s", path, ct)
}

When it happens

Trigger: Attaching or embedding an inline image in a mail shortcut whose sniffed content type is not one of image/jpeg, image/png, image/gif, image/webp — e.g. an SVG, BMP, TIFF, AVIF, HEIC, or ICO file passed as an inline attachment or template-embedded image.

Common situations: Users embedding screenshots saved as BMP/TIFF, designers attaching SVG logos inline, iPhone HEIC photos, or files renamed to .png/.jpg without actually being that format (detection is content-based, so renaming a WebP to .jpeg is fine but a renamed PDF is not).

Related errors

• set_recipients requires non-empty addresses
• %s requires address
• set_reply_to requires addresses
• body_kind must be text/plain or text/html
• selector must be primary

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/ebbffc8cc9bb9436. Report an issue: GitHub.