fix(msteams): bound response read in callUserTokenService

lizeyu-xydt · lizeyu-xydt · commit ebe27a928b58 · 2026-07-01T10:06:03.000+08:00
Replace unbounded response.json() with readResponseWithLimit to
cap the Bot Framework User Token service response at 16 MB, preventing
OOM on oversized responses. Error path was already bounded via
readMSTeamsHttpErrorDetail; this aligns the success path with the
same defensive pattern used across 50+ provider integrations.

Adds 3 new test cases: readResponseWithLimit normal read, overflow
rejection, and non-JSON response error handling.
diff --git a/extensions/msteams/src/monitor-handler.sso.test.ts b/extensions/msteams/src/monitor-handler.sso.test.ts
@@ -1,5 +1,6 @@
 // Msteams tests cover monitor handler.sso plugin behavior.
 import { describe, expect, it, vi } from "vitest";
+import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import {
   makeMSTeamsSsoTokenStoreKey,
   type MSTeamsSsoStoredToken,
@@ -66,7 +67,51 @@ function createFakeFetch(handlers: Array<(url: string, init?: unknown) => unknow
   return { fetchImpl, calls };
 }
 
+describe("readResponseWithLimit integration", () => {
+  it("reads a small JSON response successfully", async () => {
+    const body = JSON.stringify({ token: "test", connectionName: "test" });
+    const response = new Response(body, {
+      headers: { "content-type": "application/json" },
+    });
+    const buffer = await readResponseWithLimit(response, 16 * 1024 * 1024);
+    const parsed = JSON.parse(buffer.toString());
+    expect(parsed).toEqual({ token: "test", connectionName: "test" });
+  });
+
+  it("rejects an oversized response", async () => {
+    const oversized = "x".repeat(17 * 1024 * 1024);
+    const response = new Response(oversized, {
+      headers: { "content-type": "application/json" },
+    });
+    await expect(
+      readResponseWithLimit(response, 16 * 1024 * 1024),
+    ).rejects.toThrow();
+  });
+});
+
 describe("handleSigninTokenExchangeInvoke", () => {
+  it("returns an error for non-JSON response from the User Token service", async () => {
+    const { fetchImpl } = createFakeFetch([
+      () => ({
+        ok: true,
+        status: 200,
+        body: "<html>not json</html>",
+      }),
+    ]);
+    const { sso } = createSsoDeps({ fetchImpl });
+
+    const result = await handleSigninTokenExchangeInvoke({
+      value: { id: "flow-1", connectionName: "GraphConnection", token: "exchangeable-token" },
+      user: { userId: "aad-user-guid", channelId: "msteams" },
+      deps: sso,
+    });
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.code).toBe("unexpected_response");
+      expect(result.message).toContain("invalid JSON");
+    }
+  });
   it("exchanges the Teams token and persists the result", async () => {
     const { fetchImpl, calls } = createFakeFetch([
       () => ({
diff --git a/extensions/msteams/src/sso.ts b/extensions/msteams/src/sso.ts
@@ -26,6 +26,7 @@
 
 import type { MSTeamsAccessTokenProvider } from "./attachments/types.js";
 import { readMSTeamsHttpErrorDetail } from "./http-error.js";
+import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import type { MSTeamsSsoTokenStore } from "./sso-token-store.js";
 import { buildUserAgent } from "./user-agent.js";
 
@@ -130,7 +131,8 @@ async function callUserTokenService(
   }
   let parsed: unknown;
   try {
-    parsed = await response.json();
+    const buffer = await readResponseWithLimit(response, 16 * 1024 * 1024);
+    parsed = JSON.parse(buffer.toString());
   } catch {
     return { error: "invalid JSON from User Token service", status: response.status };
   }
