fix(msteams): bound User Token service JSON response reads to prevent OOM

LeonidasLux · claude · LeonidasLux · commit 250d1e826fb6 · 2026-07-07T18:16:03.000+08:00
Replace unbounded `response.json()` in `callUserTokenService` with `readProviderJsonResponse(response, "msteams.sso-user-token")` — the same shared bounded reader already deployed across the codebase (#95218, #96322, #96495, #96889). Enforces a 16 MiB default cap and cancels the underlying stream on overflow. Closes the last unbounded JSON read on the MSTeams SSO token-exchange path. Error responses were already bounded via `extractProviderErrorDetail`. Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/extensions/msteams/src/monitor-handler.sso.test.ts b/extensions/msteams/src/monitor-handler.sso.test.ts
@@ -156,6 +156,27 @@ describe("handleSigninTokenExchangeInvoke", () => {
     }
     expect(calls).toHaveLength(0);
   });
+
+  it("returns error when User Token service returns malformed JSON", async () => {
+    const fetchImpl: MSTeamsSsoFetch = async () => {
+      return new Response("not-valid-json", {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    };
+    const { sso } = createSsoDeps({ fetchImpl });
+
+    const result = await handleSigninTokenExchangeInvoke({
+      value: { id: "flow-1", connectionName: "GraphConnection", token: "exchangeable-token" },
+      user: { userId: "aad-user-guid", channelId: "msteams" },
+      deps: sso,
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.message).toContain("invalid JSON from User Token service");
+    }
+  });
 });
 
 describe("handleSigninVerifyStateInvoke", () => {
diff --git a/extensions/msteams/src/sso.ts b/extensions/msteams/src/sso.ts
@@ -24,6 +24,7 @@
  * that ack; these helpers encapsulate token exchange and persistence.
  */
 
+import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import type { MSTeamsAccessTokenProvider } from "./attachments/types.js";
 import { readMSTeamsHttpErrorDetail } from "./http-error.js";
 import type { MSTeamsSsoTokenStore } from "./sso-token-store.js";
@@ -130,7 +131,7 @@ async function callUserTokenService(
   }
   let parsed: unknown;
   try {
-    parsed = await response.json();
+    parsed = await readProviderJsonResponse(response, "msteams.sso-user-token");
   } catch {
     return { error: "invalid JSON from User Token service", status: response.status };
   }
