{"record":{"id":"901541e2cffc73a7","repo":"HKUDS/nanobot","slug":"msteams-conversation-ref-has-untrusted-service-url","errorCode":null,"errorMessage":"MSTeams conversation ref has untrusted service_url for chat_id={msg.chat_id}","messagePattern":"MSTeams conversation ref has untrusted service_url for chat_id=(.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"nanobot/channels/msteams/runtime.py","lineNumber":261,"sourceCode":"            self._server = None\n        if self._server_thread and self._server_thread.is_alive():\n            self._server_thread.join(timeout=2)\n        self._server_thread = None\n        if self._http:\n            await self._http.aclose()\n            self._http = None\n\n    async def send(self, msg: OutboundMessage) -> None:\n        \"\"\"Send a plain text reply into an existing Teams conversation.\"\"\"\n        if not self._http:\n            raise RuntimeError(\"MSTeams HTTP client not initialized\")\n\n        ref = self._conversation_refs.get(str(msg.chat_id))\n        if not ref:\n            raise RuntimeError(f\"MSTeams conversation ref not found for chat_id={msg.chat_id}\")\n\n        if not self._is_trusted_service_url(ref.service_url):\n            raise RuntimeError(\n                f\"MSTeams conversation ref has untrusted service_url for chat_id={msg.chat_id}\"\n            )\n\n        token = await self._get_access_token()\n        base_url = f\"{ref.service_url.rstrip('/')}/v3/conversations/{ref.conversation_id}/activities\"\n        use_thread_reply = self.config.reply_in_thread and bool(ref.activity_id)\n        headers = {\n            \"Authorization\": f\"Bearer {token}\",\n            \"Content-Type\": \"application/json\",\n        }\n        payload = {\n            \"type\": \"message\",\n            \"text\": msg.content or \" \",\n        }\n        if use_thread_reply:\n            payload[\"replyToId\"] = cast(str, ref.activity_id)\n\n        try:","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/HKUDS/nanobot/blob/42f37dc4c0e409eac7818a82d165c5f2757bc075/nanobot/channels/msteams/runtime.py#L243-L279","documentation":"Raised in MSTeams send() when a stored conversation reference's service_url does not match the trusted service URL for the chat, indicating the ref was captured from a different (potentially spoofed) Bot Framework endpoint. It fires as a safety guard before outbound HTTP calls so replies cannot be redirected to an attacker-controlled server.","triggerScenarios":"Thrown at nanobot/channels/msteams/runtime.py:261 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the stored conversation ref so the next inbound activity re-establishes a trusted ref","Verify the bot's Microsoft App ID and channel configuration match the tenant the messages come from","Check that the inbound webhook endpoint is only reachable via the official Bot Framework service URLs"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"42f37dc4c0e409eac7818a82d165c5f2757bc075","analyzedAt":"2026-08-26T00:18:52.276Z","contentChangedAt":"2026-08-26T00:18:52.276Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}