Update src/helpers.ts

Co-authored-by: Copilot <[email protected]>

src/helpers.ts

@@ -129,6 +129,12 @@ function validateAndMaskHeaders(headers: Record<string, unknown>): Record<string
 
     // Convert value to string
     const stringValue = String(value)
+
+    // Validate header value to prevent CRLF/header injection
+    if (stringValue.includes('\r') || stringValue.includes('\n')) {
+      core.warning(`Skipping header "${name}" because its value contains newline characters, which are not allowed in HTTP header values.`)
+      continue
+    }
     validHeaders[name] = stringValue
 
     // Mask sensitive headers in logs