diff --git a/nanobot/channels/msteams.py b/nanobot/channels/msteams.py index b184b9b07..96080d25c 100644 --- a/nanobot/channels/msteams.py +++ b/nanobot/channels/msteams.py @@ -55,6 +55,9 @@ MSTEAMS_REF_TTL_DAYS = 30 MSTEAMS_WEBCHAT_HOST = "webchat.botframework.com" MSTEAMS_DEFAULT_TRUSTED_SERVICE_URL_HOSTS = [ "smba.trafficmanager.net", + "smba.infra.gcc.teams.microsoft.com", + "smba.infra.gov.teams.microsoft.us", + "smba.infra.dod.teams.microsoft.us", "*.botframework.com", ] MSTEAMS_REF_META_FILENAME = "msteams_conversations_meta.json" diff --git a/tests/test_msteams.py b/tests/test_msteams.py index 4eb9f2146..b76d6e5fd 100644 --- a/tests/test_msteams.py +++ b/tests/test_msteams.py @@ -186,6 +186,18 @@ def test_init_prunes_stale_and_unsupported_conversation_refs(make_channel, tmp_p assert set(persisted.keys()) == {"conv-valid", "conv-missing-ts"} +def test_default_trusted_service_urls_cover_official_teams_clouds(make_channel): + ch = make_channel() + + assert ch._is_trusted_service_url("https://smba.trafficmanager.net/amer/") + assert ch._is_trusted_service_url("https://smba.infra.gcc.teams.microsoft.com/amer/") + assert ch._is_trusted_service_url("https://smba.infra.gov.teams.microsoft.us/amer/") + assert ch._is_trusted_service_url("https://smba.infra.dod.teams.microsoft.us/amer/") + assert ch._is_trusted_service_url("https://westus-api.botframework.com/") + assert not ch._is_trusted_service_url("http://smba.trafficmanager.net/amer/") + assert not ch._is_trusted_service_url("https://smba.trafficmanager.net.evil.example/") + + def test_save_prunes_unsupported_conversation_refs(make_channel, tmp_path, monkeypatch): now = 1_800_000_000.0 monkeypatch.setattr(msteams_module.time, "time", lambda: now)