@azure/msal-common 16.16.0 → 16.16.2

package/dist-browser/utils/FunctionWrappers.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -35,7 +35,8 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
         catch (e) {
             logger.trace(`0cfd8i ${eventName}`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                // Prevent numeric error details from being treated as minified log hashes.
+                logger.tracePii(`028ef8 ${JSON.stringify(e)}`, correlationId);
             }
             catch (e) {
                 logger.trace("00dty7", correlationId);
@@ -79,7 +80,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
             .catch((e) => {
             logger.trace(`0cfd8i ${eventName}`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                logger.tracePii(`028ef8 ${JSON.stringify(e)}`, correlationId);
             }
             catch (e) {
                 logger.trace("00dty7", correlationId);

package/dist-browser/utils/FunctionWrappers.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"FunctionWrappers.mjs","sources":["../../src/utils/FunctionWrappers.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAKH;;;;;;;;;;AAUG;AACH;AACO,MAAM,MAAM,GAAG,CAClB,QAA2B,EAC3B,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAO;QACrB,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QACD,IAAI;AACA,YAAA,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACjC,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;AACnD,YAAA,OAAO,MAAM,CAAC;AACjB,QAAA,CAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;AACA,gBAAA,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAClD,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CAAC;AAChB,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AACL,IAAA,CAAC,CAAC;AACN,EAAE;AAEF;;;;;;;;;;;AAWG;AACH;AACO,MAAM,WAAW,GAAG,CACvB,QAAoC,EACpC,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAgB;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACD,QAAA,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC;AACnB,aAAA,IAAI,CAAC,CAAC,QAAQ,KAAI;YACf,MAAM,CAAC,KAAK,CACR,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;YAG1C,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;AACH,YAAA,OAAO,QAAQ,CAAC;AACpB,QAAA,CAAC,CAAC;AACD,aAAA,KAAK,CAAC,CAAC,CAAC,KAAI;YACT,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;AACA,gBAAA,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAClD,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CACR;AAGP,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACZ,QAAA,CAAC,CAAC,CAAC;AACX,IAAA,CAAC,CAAC;AACN;;;;"}
+{"version":3,"file":"FunctionWrappers.mjs","sources":["../../src/utils/FunctionWrappers.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAAA;;;AAGG;AAKH;;;;;;;;;;AAUG;AACH;AACO,MAAM,MAAM,GAAG,CAClB,QAA2B,EAC3B,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAO;QACrB,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;QACD,IAAI;AACA,YAAA,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YACjC,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;AACnD,YAAA,OAAO,MAAM,CAAC;AACjB,QAAA,CAAA;AAAC,QAAA,OAAO,CAAC,EAAE;YACR,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;;AAEA,gBAAA,MAAM,CAAC,QAAQ,CACX,CAAA,OAAA,EAAA,IAAA,CAAA,SAAwB,CAAA,CAAA,CAAA,CAAA,CAAA,EAAA,aACxB,CAAA,CAAA;AAEP,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CAAC;AAChB,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACX,QAAA,CAAA;AACL,IAAA,CAAC,CAAC;AACN,EAAE;AAEF;;;;;;;;;;;AAWG;AACH;AACO,MAAM,WAAW,GAAG,CACvB,QAAoC,EACpC,SAAiB,EACjB,MAAc,EACd,eAAmC,EACnC,aAAqB,KACrB;AACA,IAAA,OAAO,CAAC,GAAG,IAAO,KAAgB;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAuB,aAAY,CAAE,CAAA;QAClD,MAAM,eAAe,GAAG,eAAe,CAAC,gBAAgB,CACpD,SAAS,EACT,aAAa,CAChB,CAAC;AACF,QAAA,IAAI,aAAa,EAAE;;AAEf,YAAA,eAAe,CAAC,eAAe,CAC3B,EAAE,CAAC,CAAA,IAAA,EAAO,SAAS,CAAA,SAAA,CAAW,GAAG,CAAC,EAAE,EACpC,aAAa,CAChB,CAAC;AACL,QAAA,CAAA;AACD,QAAA,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC;AACnB,aAAA,IAAI,CAAC,CAAC,QAAQ,KAAI;YACf,MAAM,CAAC,KAAK,CACR,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,EAAA,aAAmC,CAAA,CAAG;YAG1C,eAAe,CAAC,GAAG,CAAC;AAChB,gBAAA,OAAO,EAAE,IAAI;AAChB,aAAA,CAAC,CAAC;AACH,YAAA,OAAO,QAAQ,CAAC;AACpB,QAAA,CAAC,CAAC;AACD,aAAA,KAAK,CAAC,CAAC,CAAC,KAAI;YACT,MAAM,CAAC,KAAK,CAAC,CAAA,OAAA,EAAA,SAAA,CAAA,CAAA,eAAoC,CAAA,CAAA;YACjD,IAAI;AACA,gBAAA,MAAM,CAAC,QAAQ,CACX,CAAA,OAAA,EAAA,IAAA,CAAA,SAAwB,CAAA,CAAA,CAAA,CAAA,CAAA,EAAA,aACxB,CAAA,CAAA;AAEP,YAAA,CAAA;AAAC,YAAA,OAAO,CAAC,EAAE;AACR,gBAAA,MAAM,CAAC,KAAK,CACR;AAGP,YAAA,CAAA;YACD,eAAe,CAAC,GAAG,CACf;AACI,gBAAA,OAAO,EAAE,KAAK;aACjB,EACD,CAAC,CACJ,CAAC;AACF,YAAA,MAAM,CAAC,CAAC;AACZ,QAAA,CAAC,CAAC,CAAC;AACX,IAAA,CAAC,CAAC;AACN;;;;"}

package/dist-browser/utils/ObjectUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/ProtocolUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { RESOURCE_DELIM } from './Constants.mjs';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';

package/dist-browser/utils/StringUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/TimeUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/dist-browser/utils/UrlUtils.mjs

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 import { createClientAuthError } from '../error/ClientAuthError.mjs';
 import { createClientConfigurationError } from '../error/ClientConfigurationError.mjs';

package/lib/index-browser.cjs

@@ -1,8 +1,8 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 'use strict';
 
-var indexNode = require('./index-node-C1QI6fAD.js');
+var indexNode = require('./index-node-PSDxoU6m.js');
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.

package/lib/{index-node-C1QI6fAD.js → index-node-PSDxoU6m.js}

@@ -1,4 +1,4 @@
-/*! @azure/msal-common v16.16.0 2026-11-05 */
+/*! @azure/msal-common v16.16.2 2026-11-12 */
 'use strict';
 'use strict';
 
@@ -821,6 +821,12 @@ var Constants = /*#__PURE__*/Object.freeze({
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+// Matches ASCII controls, space, DEL, backslash, or the userinfo separator (@).
+const UNSAFE_AUTHORITY = /[\x00-\x20\x7f\\@]/;
+const DEFAULT_PORTS = {
+    "https:": ":443",
+    "http:": ":80",
+};
 /**
  * Url object class which can perform various transformations on url strings.
  */
@@ -936,6 +942,29 @@ class UrlString {
             AbsolutePath: match[5],
             QueryString: match[7],
         };
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(this.urlString);
+        }
+        catch {
+            throw createClientConfigurationError(urlParseError, this.correlationId);
+        }
+        const host = urlComponents.HostNameAndPort?.toLowerCase();
+        const schemeAndAuthority = `${urlComponents.Protocol}//${host}`;
+        const defaultPort = DEFAULT_PORTS[parsedUrl.protocol] ?? "";
+        /*
+         * Cross-check the original host; reparsing parsedUrl would hide parser differences.
+         * URL has validated IPv6 syntax, so only bracketed hosts need a normalization comparison.
+         */
+        const hostMatches = host === parsedUrl.host ||
+            host === `${parsedUrl.host}${defaultPort}` ||
+            (host?.startsWith("[") &&
+                new URL(`${urlComponents.Protocol}//${host}`).host ===
+                    parsedUrl.host);
+        // Check authority ambiguity without restricting resource paths, queries, or fragments.
+        if (UNSAFE_AUTHORITY.test(schemeAndAuthority) || !hostMatches) {
+            throw createClientConfigurationError(urlParseError, this.correlationId);
+        }
         let pathSegments = urlComponents.AbsolutePath.split("/");
         pathSegments = pathSegments.filter((val) => val && val.length > 0); // remove empty elements
         urlComponents.PathSegments = pathSegments;
@@ -1318,7 +1347,8 @@ const invoke = (callback, eventName, logger, telemetryClient, correlationId) =>
         catch (e) {
             logger.trace(`Error occurred in '${eventName}'`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                // Prevent numeric error details from being treated as minified log hashes.
+                logger.tracePii(`Error details: '${JSON.stringify(e)}'`, correlationId);
             }
             catch (e) {
                 logger.trace("Unable to print error message.", correlationId);
@@ -1362,7 +1392,7 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
             .catch((e) => {
             logger.trace(`Error occurred in '${eventName}'`, correlationId);
             try {
-                logger.trace(JSON.stringify(e), correlationId);
+                logger.tracePii(`Error details: '${JSON.stringify(e)}'`, correlationId);
             }
             catch (e) {
                 logger.trace("Unable to print error message.", correlationId);
@@ -1379,6 +1409,20 @@ const invokeAsync = (callback, eventName, logger, telemetryClient, correlationId
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Licensed under the MIT License.
  */
+// Starts with an ASCII letter; remaining characters are ASCII letters, digits, or hyphens.
+const REGION_NAME_PATTERN = /^[a-z][a-z0-9-]*$/i;
+// A region becomes a DNS label, limited to 63 octets by RFC 1035 section 2.3.4.
+const MAX_REGION_NAME_LENGTH = 63;
+/**
+ * Whether a region can safely be used as a single DNS label.
+ */
+function isValidRegion(region) {
+    return (typeof region === "string" &&
+        region.length <= MAX_REGION_NAME_LENGTH &&
+        REGION_NAME_PATTERN.test(region) &&
+        // Keep the trailing-hyphen rule explicit rather than complicating the pattern.
+        !region.endsWith("-"));
+}
 class RegionDiscovery {
     constructor(networkInterface, logger, performanceClient, correlationId) {
         this.networkInterface = networkInterface;
@@ -1438,12 +1482,16 @@ class RegionDiscovery {
             regionDiscoveryMetadata.region_source =
                 RegionDiscoverySources.ENVIRONMENT_VARIABLE;
         }
-        // If no region was auto detected from the environment or from the IMDS endpoint, mark the attempt as a FAILED_AUTO_DETECTION
-        if (!autodetectedRegionName) {
+        // Untrusted discovery values must be a single DNS label before becoming a host prefix.
+        if (!autodetectedRegionName || !isValidRegion(autodetectedRegionName)) {
+            if (autodetectedRegionName) {
+                this.logger.warning("Region discovery returned an invalid region. Using the global authority.", this.correlationId);
+            }
             regionDiscoveryMetadata.region_source =
                 RegionDiscoverySources.FAILED_AUTO_DETECTION;
+            return null;
         }
-        return autodetectedRegionName || null;
+        return autodetectedRegionName;
     }
     /**
      * Make the call to the IMDS endpoint
@@ -2724,6 +2772,9 @@ class Authority {
      * @param region string
      */
     static buildRegionalAuthorityString(host, region, correlationId, queryString) {
+        if (!isValidRegion(region)) {
+            throw createClientConfigurationError(urlParseError, correlationId);
+        }
         // Create and validate a Url string object with the initial authority string
         const authorityUrlInstance = new UrlString(host, correlationId);
         authorityUrlInstance.validateAsUri();
@@ -2734,7 +2785,7 @@ class Authority {
         }
         // Include the query string portion of the url
         const url = UrlString.constructAuthorityUriFromObject({
-            ...authorityUrlInstance.getUrlComponents(),
+            ...authorityUrlParts,
             HostNameAndPort: hostNameAndPort,
         }, correlationId).urlString;
         // Add the query string if a query string was provided
@@ -4663,7 +4714,7 @@ class Logger {
 
 /* eslint-disable header/header */
 const name = "@azure/msal-common";
-const version = "16.16.0";
+const version = "16.16.2";
 
 /*
  * Copyright (c) Microsoft Corporation. All rights reserved.
@@ -5176,19 +5227,25 @@ class CacheManager {
      * @param account
      */
     removeAccount(account, correlationId) {
-        this.removeAccountContext(account, correlationId);
         const accountKeys = this.getAccountKeys();
         const keyFilter = (key) => {
             return (key.includes(account.homeAccountId) &&
                 key.includes(account.environment));
         };
+        this.getTokenKeys()
+            .idToken.filter(keyFilter)
+            .forEach((key) => {
+            this.removeIdToken(key, correlationId);
+        });
+        this.removeAccountContext(account, correlationId);
         accountKeys.filter(keyFilter).forEach((key) => {
             this.removeItem(key, correlationId);
             this.performanceClient.incrementFields({ accountsRemoved: 1 }, correlationId);
         });
     }
     /**
-     * Removes credentials associated with the provided account
+     * Removes access and refresh tokens associated with the provided account,
+     * preserving the account and its ID tokens.
      * @param account
      */
     removeAccountContext(account, correlationId) {
@@ -5197,9 +5254,6 @@ class CacheManager {
             return (key.includes(account.homeAccountId) &&
                 key.includes(account.environment));
         };
-        allTokenKeys.idToken.filter(keyFilter).forEach((key) => {
-            this.removeIdToken(key, correlationId);
-        });
         allTokenKeys.accessToken.filter(keyFilter).forEach((key) => {
             this.removeAccessToken(key, correlationId);
         });
@@ -7587,7 +7641,8 @@ class AuthorizationCodeClient {
             throw createClientAuthError(requestCannotBeMade, request.correlationId);
         }
         // Check for new cloud instance
-        if (authCodePayload && authCodePayload.cloud_instance_host_name) {
+        if (this.config.authOptions.instanceAware === true &&
+            authCodePayload?.cloud_instance_host_name) {
             await invokeAsync(this.updateTokenEndpointAuthority.bind(this), UpdateTokenEndpointAuthority, this.logger, this.performanceClient, request.correlationId)(authCodePayload.cloud_instance_host_name, request.correlationId);
         }
         const reqTimestamp = nowSeconds();
@@ -8366,13 +8421,13 @@ function validateAuthorizationResponse(serverResponse, requestState, correlation
         decodedServerResponseState = decodeURIComponent(serverResponse.state);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId);
     }
     try {
         decodedRequestState = decodeURIComponent(requestState);
     }
     catch (e) {
-        throw createClientAuthError(invalidState, correlationId, serverResponse.state);
+        throw createClientAuthError(invalidState, correlationId);
     }
     if (decodedServerResponseState !== decodedRequestState) {
         throw createClientAuthError(stateMismatch, correlationId);
@@ -8924,4 +8979,4 @@ exports.normalizeDpopResourceRequestContext = normalizeDpopResourceRequestContex
 exports.tenantIdMatchesHomeTenant = tenantIdMatchesHomeTenant;
 exports.updateAccountTenantProfileData = updateAccountTenantProfileData;
 exports.version = version;
-//# sourceMappingURL=index-node-C1QI6fAD.js.map
+//# sourceMappingURL=index-node-PSDxoU6m.js.map