fix(msteams): reject malformed OAuth token envelopes

Alix-007 · Leon-SK668 · commit 1d61563a92b1 · 2026-07-20T12:07:53.000+08:00
diff --git a/extensions/msteams/src/oauth.test.ts b/extensions/msteams/src/oauth.test.ts
@@ -274,6 +274,23 @@ describe("exchangeMSTeamsCodeForTokens", () => {
       }),
     ).rejects.toThrow("MSTeams token exchange failed: invalid token response fields");
   });
+
+  it.each([
+    { label: "null", body: null },
+    { label: "array", body: [] },
+  ])("rejects a top-level $label token exchange response", async ({ body }) => {
+    fetchSpy.mockResolvedValueOnce(responseJson(body));
+
+    await expect(
+      exchangeMSTeamsCodeForTokens({
+        tenantId: "t",
+        clientId: "c",
+        clientSecret: "s", // pragma: allowlist secret
+        code: "invalid-shape",
+        verifier: "v",
+      }),
+    ).rejects.toThrow("MSTeams token exchange failed: invalid token response fields");
+  });
 });
 
 describe("refreshMSTeamsDelegatedTokens", () => {
@@ -374,4 +391,20 @@ describe("refreshMSTeamsDelegatedTokens", () => {
       }),
     ).rejects.toThrow("MSTeams token refresh failed: malformed JSON response");
   });
+
+  it.each([
+    { label: "null", body: null },
+    { label: "array", body: [] },
+  ])("rejects a top-level $label token refresh response", async ({ body }) => {
+    fetchSpy.mockResolvedValueOnce(responseJson(body));
+
+    await expect(
+      refreshMSTeamsDelegatedTokens({
+        tenantId: "t",
+        clientId: "c",
+        clientSecret: "s", // pragma: allowlist secret
+        refreshToken: "rt",
+      }),
+    ).rejects.toThrow("MSTeams token refresh failed: invalid token response fields");
+  });
 });
diff --git a/extensions/msteams/src/oauth.token.ts b/extensions/msteams/src/oauth.token.ts
@@ -46,6 +46,17 @@ function resolveMSTeamsTokenExpiresAt(value: unknown): number | undefined {
   return resolveExpiresAtMsFromDurationSeconds(value, { bufferMs: EXPIRY_BUFFER_MS });
 }
 
+function assertMSTeamsTokenResponseObject(
+  data: unknown,
+  failureLabel: string,
+): Record<string, unknown> {
+  // JSON.parse can yield null or arrays even when the provider response is typed as an object.
+  if (data === null || typeof data !== "object" || Array.isArray(data)) {
+    throw new Error(`MSTeams ${failureLabel} failed: invalid token response fields`);
+  }
+  return data as Record<string, unknown>;
+}
+
 function parseMSTeamsTokenResponse(
   data: Record<string, unknown>,
   failureLabel: string,
@@ -93,11 +104,14 @@ async function fetchMSTeamsTokens(params: {
     if (!response.ok) {
       throw await createMSTeamsHttpError(response, `MSTeams ${params.failureLabel} failed`);
     }
-    const data = await readProviderJsonResponse<Record<string, unknown>>(
+    const data = await readProviderJsonResponse<unknown>(
       response,
       `MSTeams ${params.failureLabel} failed`,
     );
-    return parseMSTeamsTokenResponse(data, params.failureLabel);
+    return parseMSTeamsTokenResponse(
+      assertMSTeamsTokenResponseObject(data, params.failureLabel),
+      params.failureLabel,
+    );
   } finally {
     await release();
   }
