fix(security): chat attachment XSS, MCP OAuth SSRF guards, Teams clientState verification#4877

Merged

waleedlatif1 merged 6 commits into

Jun 4, 2026

Commits on Jun 4, 2026

fix(chat): prevent XSS in attachment preview via filename/data URL escaping
waleedlatif1
committed
fix(mcp): guard OAuth discovery and token revocation against SSRF
waleedlatif1
committed
fix(webhooks): verify Graph clientState on Teams chat-subscription notifications
waleedlatif1
committed
fix(webhooks): fail closed when Teams chat-subscription webhook id is unavailable
waleedlatif1
committed
docs(mcp): note AbortSignal does not bound SSRF-guard DNS lookup
waleedlatif1
committed
improvement(chat): hoist HTML escape map to module-level constant
waleedlatif1
committed