inline image extension %q is not allowed; supported formats:

Error message

inline image extension %q is not allowed; supported formats: jpg, jpeg, png, gif, webp

What it means

CheckInlineImageFormat only permits whitelisted image extensions (jpg, jpeg, png, gif, webp) for inline images, to prevent extension spoofing and MIME forgery; the extension must match the whitelist and the content must then pass content sniffing. This error is returned when the filename's extension is not on the whitelist. Wrapped into a typed ValidationError by the mail command layer.

Source

Thrown at shortcuts/mail/filecheck/filecheck.go:159

// allowedInlineMIMETypes is the whitelist of MIME types allowed for inline
// images, checked via content sniffing (http.DetectContentType).
var allowedInlineMIMETypes = map[string]struct{}{
	"image/jpeg": {},
	"image/png":  {},
	"image/gif":  {},
	"image/webp": {},
}

// CheckInlineImageFormat validates that the file is an allowed inline image
// format by checking both extension and content-sniffed MIME type.
// Both must match the whitelist to prevent extension spoofing and MIME forgery.
// On success it returns the detected MIME type; callers MUST use this as the
// final Content-Type instead of trusting any user-supplied or inherited value.
func CheckInlineImageFormat(filename string, content []byte) (string, error) {
	ext := strings.ToLower(strings.TrimPrefix(filepath.Ext(filename), "."))
	if _, ok := allowedInlineExtensions[ext]; !ok {
		return "", fmt.Errorf("inline image extension %q is not allowed; supported formats: jpg, jpeg, png, gif, webp", ext) //nolint:forbidigo // intermediate mail file-format check; mail command layer wraps into typed ValidationError.
	}
	detected := http.DetectContentType(content)
	// DetectContentType may return params (e.g. "text/plain; charset=utf-8"),
	// strip to the base media type.
	if i := strings.IndexByte(detected, ';'); i != -1 {
		detected = strings.TrimSpace(detected[:i])
	}
	if _, ok := allowedInlineMIMETypes[detected]; !ok {
		return "", fmt.Errorf("inline image content type %q does not match an allowed image format; supported: image/jpeg, image/png, image/gif, image/webp", detected) //nolint:forbidigo // intermediate mail file-format check; mail command layer wraps into typed ValidationError.
	}
	return detected, nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Convert the image to a supported format (PNG or JPEG) before inlining.
For vector graphics like SVG, rasterize to PNG or attach as a regular file/link instead of inlining.
Rename files without an extension to include the correct supported extension (only if the content truly is that image type).
Prefer PNG for graphics/screenshots and JPEG for photos to stay clearly within the whitelist.

Example fix

// before
b.AddFileInline("logo.svg", "image/svg+xml") // not in whitelist
// after
// convert logo.svg -> logo.png first
b.AddFileInline("logo.png", "image/png")

Defensive patterns

Strategy: validation

Validate before calling

allowed := map[string]bool{"jpg": true, "jpeg": true, "png": true, "gif": true, "webp": true}
ext := strings.ToLower(strings.TrimPrefix(filepath.Ext(name), "."))
if !allowed[ext] {
    return fmt.Errorf("convert %s to jpg/png/gif/webp before inlining", name)
}

Try / catch

mime, err := filecheck.CheckInlineImageFormat(name, data)
if err != nil {
    var verr *ValidationError
    if errors.As(err, &verr) {
        return fmt.Errorf("inline image %s unsupported: %w", name, verr)
    }
    return err
}
// use returned mime as the final Content-Type

Prevention

Normalize image assets to jpg/png/gif/webp in your asset pipeline before inlining.
Always use the MIME type returned by CheckInlineImageFormat instead of a caller-supplied one.
Treat SVG/HEIC/TIFF as non-inline formats and attach or link them instead.
Validate template image paths to point only at whitelisted image files.

When it happens

Trigger: Calling AddFileInline (or loadAndAttachInline / replaceInline / embedTemplateInlineAttachments) with a filename whose lowercased extension is not one of jpg, jpeg, png, gif, webp — e.g. .svg, .bmp, .tiff, .heic, or a file with no extension.

Common situations: Inlining SVG logos or HEIC photos from phones; BMP screenshots; template image paths pointing at non-image files or extensionless files; designers providing TIFF assets.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/b8fdfbf56d7ed3b5. Report an issue: GitHub.