From 2d7dbd5df1a7defca6311a534a6afbb07dff2ce8 Mon Sep 17 00:00:00 2001
From: "sentry[bot]" <39604003+sentry[bot]@users.noreply.github.com>
Date: Fri, 28 Aug 2026 07:33:14 +0000
Subject: [PATCH] fix: Validate and sanitize Codecov token before use in
 Authorization header

---
 codecov_cli/helpers/request.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/codecov_cli/helpers/request.py b/codecov_cli/helpers/request.py
index bd1c9a173..86d220ef8 100644
--- a/codecov_cli/helpers/request.py
+++ b/codecov_cli/helpers/request.py
@@ -101,6 +101,23 @@ def send_get_request(
     return request_result(get(url=url, headers=headers, params=params))
 
 
+def _validate_token(token: str) -> str:
+    """
+    Strips leading/trailing whitespace from the token and raises a
+    ClickException if the token still contains newline or carriage-return
+    characters (e.g. when a YAML block was passed instead of a plain UUID).
+    """
+    token = str(token).strip()
+    if "\n" in token or "\r" in token:
+        raise click.ClickException(
+            "The Codecov token contains newline or carriage-return characters, "
+            "which are not allowed in an HTTP header. "
+            "Please set CODECOV_TOKEN (or the -t flag) to the plain token UUID only, "
+            "not a YAML block (e.g. 'codecov:\\n  token: <uuid>')."
+        )
+    return token
+
+
 def get_token_header_or_fail(token: Optional[str]) -> dict:
     """
     Rejects requests with no Authorization token. Prevents tokenless uploads.
@@ -109,6 +126,7 @@ def get_token_header_or_fail(token: Optional[str]) -> dict:
         raise click.ClickException(
             "Codecov token not found. Please provide Codecov token with -t flag."
         )
+    token = _validate_token(token)
     return {"Authorization": f"token {token}"}
 
 
@@ -118,6 +136,7 @@ def get_token_header(token: Optional[str]) -> Optional[dict]:
     """
     if token is None:
         return None
+    token = _validate_token(token)
     return {"Authorization": f"token {token}"}