Harden IMDS region parsing against malformed responses

Treat a non-string resp.text (json.loads raising TypeError) and a
non-string location field as malformed IMDS responses and fall back to
None, so region auto-detection cannot raise during client setup.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Robbie-Microsoft

msal/region.py

@@ -55,8 +55,14 @@ def _detect_region_of_azure_vm(http_client):
     else:
         try:
             location = json.loads(resp.text).get("location")
-        except (ValueError, AttributeError):
+        except (ValueError, AttributeError, TypeError):
+            # ValueError: body is not valid JSON;
+            # AttributeError: body is valid JSON but not a JSON object;
+            # TypeError: resp.text is not a string (e.g. a custom http_client).
             logger.info("IMDS {} returned a malformed response.".format(url))
             return None
+        if location is not None and not isinstance(location, str):
+            logger.info("IMDS {} returned a non-string location.".format(url))
+            return None
         return _validate_region(location, source="IMDS endpoint")
 

tests/test_region.py

@@ -1,5 +1,6 @@
 import os
 import unittest
+from types import SimpleNamespace
 from unittest.mock import patch
 
 from msal.region import (
@@ -116,6 +117,17 @@ def test_invalid_location_value_returns_none(self):
             MinimalResponse(status_code=200, text='{"location": "evil.com/hijack"}'))
         self.assertIsNone(_detect_region_of_azure_vm(client))
 
+    def test_non_string_location_returns_none(self):
+        client = _StubHttpClient(
+            MinimalResponse(status_code=200, text='{"location": 123}'))
+        self.assertIsNone(_detect_region_of_azure_vm(client))
+
+    def test_non_string_response_text_returns_none(self):
+        # A custom http_client could yield a non-string resp.text; json.loads
+        # would raise TypeError, which must be treated as a malformed response.
+        client = _StubHttpClient(SimpleNamespace(status_code=200, text=None))
+        self.assertIsNone(_detect_region_of_azure_vm(client))
+
     def test_network_failure_returns_none(self):
         client = _StubHttpClient(IOError("IMDS unreachable"))
         self.assertIsNone(_detect_region_of_azure_vm(client))