- 已装运
- 2026年8月5日 07:24 UTC
- 作者
- Kamo
- 提交
- c7cb180
Adversarial review of 6df0008 confirmed 24 findings. The important ones: CRITICAL — any member could delete a colleague's mail. Teams voicemail ids were composed as "{mailbox}|{graphMessageId}", and mark-read / delete / fetch split the caller-supplied id and used its mailbox half verbatim as /users/{mailbox} on the org's application token — which can reach every mailbox in the tenant. The mailbox+messageId pairs were handed out by GET /instances/{id}/voicemails, so it was not even a guessing game. The mailbox is now resolved solely from the calling member's own Microsoft connection and is not derivable from anything a client sends; org-scoped work (sync, health) resolves no mailbox and reads none. That also stops instance sync walking every colleague's mailbox on the app token. Dropping the mailbox from the id fixes two more confirmed defects for free: the ids were ~190-240 chars against a VARCHAR(128) column (every persist failed), and the '|' made Tomcat reject the URL with a 400 before Spring routing, so mark-read, archive and delete never reached the server at all. Extension ids move to '~' for the same reason, and the Teams routing suffix (+1425...;ext=1234, 21 chars) is now trimmed to fit EXTENSION_NUMBER's VARCHAR(20) instead of failing the sync. HIGH — call history was silently empty for most members. getPstnCalls is a tenant-wide feed with no per-user filter, and the code capped the fetch at 2000 rows BEFORE filtering, so in any tenant with more than ~2000 PSTN calls in 90 days the cap was consumed by other people's rows. Filtering now happens during paging and stops as soon as the requested page is full. HIGH — Graph notifications were processed inline on the response thread: N sequential Graph round-trips against a three-second acknowledgement budget. Past 15% slow responses in ten minutes Graph marks the endpoint "drop" and discards notifications for ten minutes. Validation stays inline; the work moves to a bounded caller-runs executor. HIGH — the member-connect state carried a memberId but nothing tied it to the person completing the sign-in, so a member could hand their connect URL to a colleague and end up with the colleague's Teams identity on their own row. Self- connect now requires the Microsoft sign-in to match the member's Kamo email; connecting on someone's behalf stays allowed and is recorded in the state. HIGH — MemberVoipConfigController trusted the path memberId with no org check on GET or PUT, and nothing upstream supplied one: a cross-tenant IDOR over every member's VOIP config, now including their Entra object id. Pre-existing, but this commit is what put an identity in that payload. Also: TeamsNeedsReconnectException returned 500 instead of 409 for the expected "not connected yet" state; the ACS endpoint was unvalidated operator config that a delegated calling token was POSTed to (now scheme- and host-pinned); concurrent subscription upkeep could orphan a Graph subscription against the 100-per-org quota; and acsEndpoint is redacted because operators paste whole connection strings into it. Verified: mvn test — 136 tests, 0 failures.