fix(msteams): bound federated certificate file reads

xydt-juyaohui · xydt-juyaohui · commit b77f3dc73d36 · 2026-07-17T17:50:47.000+08:00
createFederatedApp read the certificate path with an unbounded fs.readFileSync, so a misconfigured or oversized certificate file could trigger an unbounded read at credential-load time. Adopt tryReadSecretFileSync (the same helper the credential-reader sweep in #109260 applied to anthropic-vertex / google / gh-read / mantis) with a 1 MiB maxBytes bound so oversized certificate files are rejected at the size check rather than read whole. Missing or empty files surface as the existing "Failed to read certificate file" error. Update the sdk tests to mock tryReadSecretFileSync and add a regression case asserting an oversized file (helper returns undefined) fails the load with the bound applied.
diff --git a/extensions/msteams/src/sdk.test.ts b/extensions/msteams/src/sdk.test.ts
@@ -1,5 +1,4 @@
 // Msteams tests cover sdk plugin behavior.
-import * as fs from "node:fs";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { createMSTeamsTokenProvider, loadMSTeamsSdkWithAuth } from "./sdk.js";
 import type { MSTeamsCredentials, MSTeamsFederatedCredentials } from "./token.js";
@@ -14,6 +13,15 @@ vi.mock("node:fs", async (importOriginal) => {
   };
 });
 
+const { tryReadSecretFileSyncMock } = vi.hoisted(() => ({
+  tryReadSecretFileSyncMock: vi.fn<
+    (filePath: string, label: string, options: unknown) => string | undefined
+  >(() => "-----BEGIN RSA PRIVATE KEY-----\nfake-key\n-----END RSA PRIVATE KEY-----"),
+}));
+vi.mock("openclaw/plugin-sdk/secret-file-runtime", () => ({
+  tryReadSecretFileSync: tryReadSecretFileSyncMock,
+}));
+
 const { mockGetToken } = vi.hoisted(() => {
   const mockGetTokenLocal = vi.fn().mockResolvedValue({ token: "mock-managed-token" });
   return { mockGetToken: mockGetTokenLocal };
@@ -76,13 +84,15 @@ describe("createMSTeamsApp", () => {
 
     const app = await createMSTeamsApp(creds);
     expect(app).toBeDefined();
-    expect(fs.readFileSync).toHaveBeenCalledWith("/path/to/cert.pem", "utf-8");
+    expect(tryReadSecretFileSyncMock).toHaveBeenCalledWith(
+      "/path/to/cert.pem",
+      "MS Teams federated certificate",
+      expect.objectContaining({ maxBytes: 1024 * 1024 }),
+    );
   });
 
   it("throws when certificate file is missing", async () => {
-    vi.mocked(fs.readFileSync).mockImplementation(() => {
-      throw new Error("ENOENT: no such file");
-    });
+    tryReadSecretFileSyncMock.mockReturnValueOnce(undefined);
 
     const creds: MSTeamsFederatedCredentials = {
       type: "federated",
@@ -94,6 +104,26 @@ describe("createMSTeamsApp", () => {
     await expect(createMSTeamsApp(creds)).rejects.toThrow("Failed to read certificate file");
   });
 
+  it("throws when the certificate file exceeds the size bound", async () => {
+    // tryReadSecretFileSync returns undefined for an oversized file (its own
+    // maxBytes guard rejects it); the load path must surface that as a failure.
+    tryReadSecretFileSyncMock.mockReturnValueOnce(undefined);
+
+    const creds: MSTeamsFederatedCredentials = {
+      type: "federated",
+      appId: "test-app-id",
+      tenantId: "test-tenant",
+      certificatePath: "/path/to/huge.pem",
+    };
+
+    await expect(createMSTeamsApp(creds)).rejects.toThrow("Failed to read certificate file");
+    expect(tryReadSecretFileSyncMock).toHaveBeenCalledWith(
+      "/path/to/huge.pem",
+      "MS Teams federated certificate",
+      expect.objectContaining({ maxBytes: 1024 * 1024 }),
+    );
+  });
+
   it("creates app with managed identity credentials", async () => {
     const creds: MSTeamsFederatedCredentials = {
       type: "federated",
diff --git a/extensions/msteams/src/sdk.ts b/extensions/msteams/src/sdk.ts
@@ -1,12 +1,16 @@
 // Msteams plugin module implements sdk behavior.
-import * as fs from "node:fs";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
 import { normalizeBotFrameworkServiceUrl } from "./bot-framework-service-url.js";
 import type { MSTeamsCloudName } from "./cloud.js";
 import { MSTEAMS_REQUEST_TIMEOUT_MS } from "./request-timeout.js";
 import type { MSTeamsCredentials, MSTeamsFederatedCredentials } from "./token.js";
 import { buildOpenClawUserAgentFragment } from "./user-agent.js";
 
+// Bound the federated certificate file read so a misconfigured or oversized
+// path cannot trigger an unbounded read at credential-load time.
+const MSTEAMS_CERTIFICATE_MAX_BYTES = 1024 * 1024;
+
 type MSTeamsHttpServerAdapter =
   import("@microsoft/teams.apps/dist/http/adapter.js").IHttpServerAdapter;
 
@@ -319,13 +323,22 @@ function createFederatedApp(
 
   let privateKey: string;
   try {
-    privateKey = fs.readFileSync(creds.certificatePath, "utf-8");
+    privateKey =
+      tryReadSecretFileSync(creds.certificatePath, "MS Teams federated certificate", {
+        maxBytes: MSTEAMS_CERTIFICATE_MAX_BYTES,
+        rejectHardlinks: false,
+      }) ?? "";
   } catch (err: unknown) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`Failed to read certificate file at '${creds.certificatePath}': ${msg}`, {
       cause: err,
     });
   }
+  if (!privateKey) {
+    throw new Error(
+      `Failed to read certificate file at '${creds.certificatePath}': file is empty or missing`,
+    );
+  }
 
   return createCertificateApp(creds, privateKey, App, appOptions);
 }
