From f77380037bacb97381df075c08090d8f627de479 Mon Sep 17 00:00:00 2001
From: Yonatan Golick <69797900+yg1996@users.noreply.github.com>
Date: Sun, 18 Jan 2026 11:59:12 +0200
Subject: [PATCH] Update src/helpers.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 src/helpers.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/helpers.ts b/src/helpers.ts
index 1b45aa2..765ad77 100644
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -129,6 +129,12 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
 
     // Convert value to string
     const stringValue = String(value)
+
+    // Validate header value to prevent CRLF/header injection
+    if (stringValue.includes('\r') || stringValue.includes('\n')) {
+      core.warning(`Skipping header "${name}" because its value contains newline characters, which are not allowed in HTTP header values.`)
+      continue
+    }
     validHeaders[name] = stringValue
 
     // Mask sensitive headers in logs