What causes "%s contains invalid line break characters" in larksuite/cli?

Strip CR/LF from the input before passing it (strings.ReplaceAll / strings.TrimSpace).

%s contains invalid line break characters

Error message

%s contains invalid line break characters

What it means

RejectCRLF validates that a caller-supplied string contains no carriage return (\r) or line feed (\n) characters. CRLF in fields like header names/values or MIME boundaries enables header-injection attacks, so this validator fails fast. The fieldName argument is interpolated into the message so the user knows which field was rejected.

Source

Thrown at internal/validate/input.go:27

	"github.com/larksuite/cli/internal/charcheck"
)

// RejectControlChars rejects C0 control characters (except \t and \n) and
// dangerous Unicode characters from user input.
//
// Delegates to charcheck.RejectControlChars — the single source of truth
// for character-level security checks.
func RejectControlChars(value, flagName string) error {
	return charcheck.RejectControlChars(value, flagName)
}

// RejectCRLF rejects strings containing carriage return (\r) or line feed (\n).
// These characters enable MIME/HTTP header injection and must never appear in
// header field names, values, Content-ID, or filename parameters.
func RejectCRLF(value, fieldName string) error {
	if strings.ContainsAny(value, "\r\n") {
		return fmt.Errorf("%s contains invalid line break characters", fieldName)
	}
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Strip CR/LF from the input before passing it (strings.ReplaceAll / strings.TrimSpace).
If multi-line content is intended, pass it through a field that supports it (e.g. file upload or body content) rather than a single-line header-like field.
Quote shell variables and avoid untrimmed $(...) substitutions when populating the flag.
Encode the content (e.g. base64) if a transport requires single-line values.

Example fix

// before
lark-cli im message create --subject "$SUBJECT"
// after
SUBJECT=$(printf '%s' "$SUBJECT" | tr -d '\r\n')
lark-cli im message create --subject "$SUBJECT"

Defensive patterns

Strategy: validation

Validate before calling

if strings.ContainsAny(value, "\r\n") {
    return fmt.Errorf("%s must not contain line breaks", flagName)
}

Try / catch

if err := validate.RejectCRLF(subject, "--subject"); err != nil {
    return fmt.Errorf("fix --subject: %w", err)
}

Prevention

Trim and strip CR/LF from any single-line field before passing it to the CLI.
Quote shell variables; avoid raw $(...) expansion into single-line flags.
Prefer file/body parameters for multi-line content.
Add RejectCRLF to your own form/API boundary before values reach header-like fields.

When it happens

Trigger: Any call to validate.RejectCRLF with a string containing \r or \n, e.g. user input passed via flags into header names/values, MIME part construction (newInlinePart), inline replacement (replaceInline), or validateCID.

Common situations: Pasting multi-line content into a single-value flag, shell scripts with accidental newlines from command substitution, data read from files without trimming the trailing newline, or crafted input attempting header injection.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/d2eb4a2d49a210ac. Report an issue: GitHub.