@mindstone/mcp-server-microsoft-teams 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this connector will be documented in this file.
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-08-10
+
+### Changed
+
+- Re-sync the vendored envelope helper with the hardened canonical: attribute-bearing close tags and spoofed open tags escaped.
+
+### Fixed
+
+- Re-synced the vendored `<untrusted-content>` envelope helper with the canonical hardened reference: attribute-bearing close-tag variants (`</untrusted-content foo>`) and spoofed open tags inside wrapped content are now escaped, closing an envelope-breakout gap an LLM parser could read as an envelope boundary.
+
 ## [0.3.0] - 2026-08-07
 
 ### Changed

package/README.md

@@ -9,7 +9,7 @@ Microsoft 365 Teams MCP server — list and read Teams chats and channel message
 
 ## Status
 
-- **Version:** [0.3.0](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-microsoft-teams)
+- **Version:** [0.3.1](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-microsoft-teams)
 - **Auth:** OAuth (host-orchestrated, shared with [`mcp-server-microsoft-mail`](../microsoft-mail/)) ([`MS_CLIENT_ID`](./server.json))
 - **Tools:** [17](./src/tools.ts) (chats, messages, teams, channels, users, search, presence)
 - **Surface:** cloud-api

package/dist/untrusted-content.d.ts

@@ -20,15 +20,15 @@
  */
 /**
  * Wrap a single untrusted string in an `<untrusted-content source="…">`
- * envelope, escaping any embedded close-tag variant so the envelope cannot be
- * broken out of.
+ * envelope, escaping any embedded open/close-tag variant so the envelope can
+ * neither be broken out of nor have a spoofed nested envelope planted inside.
  *
  * `undefined` and `null` are passed through untouched so callers can apply the wrapper
  * uniformly to optional fields without branching.
  *
  * Idempotent: when `text` is already a properly-shaped envelope for the SAME
  * `source` (starts with the matching OPEN tag, ends with CLOSE, and contains no
- * internal close-tag variants), the original string is returned unchanged so
+ * internal open/close-tag variants), the original string is returned unchanged so
  * `wrapUntrusted(wrapUntrusted(s, src), src) === wrapUntrusted(s, src)`.
  */
 export declare function wrapUntrusted(text: string | null | undefined, source: string): string | undefined;

package/dist/untrusted-content.js

@@ -18,34 +18,44 @@
  * `untrusted-content` in any connector that talks to an external system; this
  * file (and the call sites that import from it) is what satisfies that gate.
  */
-const UNTRUSTED_CLOSE_TAG_VARIANT = /<\/untrusted-content\s*>/gi;
+const UNTRUSTED_CLOSE_TAG_VARIANT = /<\/untrusted-content(?:\s[^>]*)?>/gi;
 const ESCAPED_UNTRUSTED_CLOSE_TAG = '<\\/untrusted-content>';
+const UNTRUSTED_OPEN_TAG_VARIANT = /<untrusted-content(?:\s[^>]*)?>/gi;
+const ESCAPED_UNTRUSTED_OPEN_TAG = '<\\untrusted-content>';
 const UNTRUSTED_ENVELOPE = /^<untrusted-content source="[^"]*">([\s\S]*)<\/untrusted-content>$/;
 function escapeAttr(s) {
     return s.replaceAll('&', '&amp;').replaceAll('"', '&quot;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
 }
 /**
- * Rewrite every `</untrusted-content>` variant (case-insensitive, optional
- * whitespace before `>`) inside `s` to a benign textual form, so an attacker
- * who controls the wrapped content cannot terminate the envelope early.
+ * Rewrite every `</untrusted-content>` and `<untrusted-content …>` variant
+ * (case-insensitive, optional whitespace / attributes before `>`) inside `s`
+ * to a benign textual form, so an attacker who controls the wrapped content
+ * can neither terminate the envelope early nor spoof a nested open tag that a
+ * downstream parser could re-read as a fresh envelope. An LLM parsing the
+ * markup plausibly accepts attribute-bearing close forms such as
+ * `</untrusted-content foo>` — the matcher must cover them too.
  */
-function escapeCloseTagSentinels(s) {
-    return s.replace(UNTRUSTED_CLOSE_TAG_VARIANT, ESCAPED_UNTRUSTED_CLOSE_TAG);
+function escapeTagSentinels(s) {
+    return s
+        .replace(UNTRUSTED_OPEN_TAG_VARIANT, ESCAPED_UNTRUSTED_OPEN_TAG)
+        .replace(UNTRUSTED_CLOSE_TAG_VARIANT, ESCAPED_UNTRUSTED_CLOSE_TAG);
 }
-function unescapeCloseTagSentinels(s) {
-    return s.replaceAll(ESCAPED_UNTRUSTED_CLOSE_TAG, '</untrusted-content>');
+function unescapeTagSentinels(s) {
+    return s
+        .replaceAll(ESCAPED_UNTRUSTED_OPEN_TAG, '<untrusted-content>')
+        .replaceAll(ESCAPED_UNTRUSTED_CLOSE_TAG, '</untrusted-content>');
 }
 /**
  * Wrap a single untrusted string in an `<untrusted-content source="…">`
- * envelope, escaping any embedded close-tag variant so the envelope cannot be
- * broken out of.
+ * envelope, escaping any embedded open/close-tag variant so the envelope can
+ * neither be broken out of nor have a spoofed nested envelope planted inside.
  *
  * `undefined` and `null` are passed through untouched so callers can apply the wrapper
  * uniformly to optional fields without branching.
  *
  * Idempotent: when `text` is already a properly-shaped envelope for the SAME
  * `source` (starts with the matching OPEN tag, ends with CLOSE, and contains no
- * internal close-tag variants), the original string is returned unchanged so
+ * internal open/close-tag variants), the original string is returned unchanged so
  * `wrapUntrusted(wrapUntrusted(s, src), src) === wrapUntrusted(s, src)`.
  */
 export function wrapUntrusted(text, source) {
@@ -55,13 +65,14 @@ export function wrapUntrusted(text, source) {
     const close = '</untrusted-content>';
     if (text.startsWith(open) && text.endsWith(close) && text.length >= open.length + close.length) {
         const inner = text.slice(open.length, text.length - close.length);
-        if (!UNTRUSTED_CLOSE_TAG_VARIANT.test(inner)) {
-            UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0; // reset stateful /g regex
+        const hasVariant = UNTRUSTED_CLOSE_TAG_VARIANT.test(inner) || UNTRUSTED_OPEN_TAG_VARIANT.test(inner);
+        UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0; // reset stateful /g regexes
+        UNTRUSTED_OPEN_TAG_VARIANT.lastIndex = 0;
+        if (!hasVariant) {
             return text;
         }
-        UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0;
     }
-    return `${open}${escapeCloseTagSentinels(text)}${close}`;
+    return `${open}${escapeTagSentinels(text)}${close}`;
 }
 /**
  * Strip one `<untrusted-content>` envelope from `text` if present, returning raw
@@ -73,7 +84,7 @@ export function unwrapUntrusted(text) {
     const match = UNTRUSTED_ENVELOPE.exec(text);
     if (!match)
         return text;
-    return unescapeCloseTagSentinels(match[1]);
+    return unescapeTagSentinels(match[1]);
 }
 /**
  * Recursively wrap every string key and value reachable inside `value` (strings,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindstone/mcp-server-microsoft-teams",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "mcpName": "io.github.mindstone/mcp-server-microsoft-teams",
   "description": "Microsoft 365 Teams via Graph: list chats, read/send messages, list teams/channels, presence.",
   "license": "FSL-1.1-MIT",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.mindstone/mcp-server-microsoft-teams",
   "title": "Microsoft 365 Teams",
   "description": "Microsoft 365 Teams via Graph: list chats, read/send messages, list teams/channels, presence.",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "repository": {
     "url": "https://github.com/mindstone/mcp-servers",
     "source": "github",
@@ -14,7 +14,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@mindstone/mcp-server-microsoft-teams",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"