Bug: HTTP splitting vulnerability

[K-Pomian]

Describe the bug.

Static scan showed that in agreementbot/api.go and api/api.go there's a possibility of HTTP splitting.
In both files, within the listen function, a header with the key Access-Control-Allow-Origin is added. However, its value is not validated for potential CRLF injection, which could lead to HTTP request splitting.

Describe the steps to reproduce the behavior.

No response

Expected behavior.

No response

Screenshots.

No response

Operating Environment

Linux

Additional Information

No response