brightspace-mcp-server 5.0.12 → 5.0.13

package/build/tools/schemas.js

@@ -70,7 +70,7 @@ export const DownloadFileSchema = z.object({
     topicId: z.coerce.number().int().positive().optional()
         .describe("Content topic ID to download (for course content files)."),
     coursePath: z.string().min(1).max(1024).optional()
-        .describe("A file in the course's file store, for files an instructor linked inside a module or page description instead of adding as a content topic (get_course_content lists them as courseFiles on the module). Pass one of those paths (e.g. 'Notes/Lecture 1.pdf') or the whole quickLink URL. Not combined with topicId, folderId, or newsId."),
+        .describe("A file in the course's file store, for files an instructor linked inside a module or page description instead of adding as a content topic (get_course_content lists them as courseFiles on the module). Pass one of those paths (e.g. 'Notes/Lecture 1.pdf'), the whole quickLink URL, or a '/content/enforced/<course folder>/...' link exactly as another tool (e.g. get_assignments) returned it. Not combined with topicId, folderId, or newsId."),
     folderId: z.coerce.number().int().positive().optional()
         .describe("Dropbox folder ID. Downloads your submission by default; set source to assignmentAttachment for an instructor-provided handout."),
     fileId: z.coerce.number().int().positive().optional()

package/build/utils/course-files.js

@@ -6,10 +6,12 @@
 import { tagAttributes } from "./html-attributes.js";
 import { toBrightspacePath } from "./transcript/lti.js";
 export const QUICKLINK_PATH = "/d2l/common/dialogs/quickLink/quickLink.d2l";
+const ENFORCED_PREFIX = "/content/enforced/";
 /**
  * Reduce a coursePath argument to a plain course-file path ("Notes/a.pdf").
- * Accepts that path or the quickLink URL a module description carries, and
- * refuses anything that could name a file outside the course file store, so
+ * Accepts that path, the quickLink URL a module description carries, or the
+ * `/content/enforced/<course folder>/...` href an assignment's instructions
+ * carry, and refuses anything that could name a file outside the course file store, so
  * the argument can only ever steer the request inside this course's files.
  * An absolute quickLink URL must be on `origin`; without one, only a
  * root-relative link is accepted.
@@ -19,16 +21,10 @@ export function parseCoursePath(input, courseId, origin) {
     // A plain course-file path never starts with "/" or names a scheme, so
     // anything that does is a link, however its file name reads.
     if (filePath.startsWith("/") || /^[a-z][a-z\d+.-]*:\/\//i.test(filePath)) {
-        const brightspacePath = toBrightspacePath(filePath, origin);
-        const link = brightspacePath === null ? null : new URL(brightspacePath, "https://placeholder.invalid");
-        if (link === null || link.pathname !== QUICKLINK_PATH || link.searchParams.get("type") !== "coursefile") {
-            return { error: "coursePath must be a course file path or a quickLink URL on this Brightspace with type=coursefile." };
-        }
-        const ou = link.searchParams.get("ou");
-        if (ou !== null && ou !== String(courseId)) {
-            return { error: `This quickLink belongs to course ${ou}, not course ${courseId}.` };
-        }
-        filePath = link.searchParams.get("fileId") ?? "";
+        const linked = enforcedFilePath(filePath, courseId, origin) ?? quickLinkFilePath(filePath, courseId, origin);
+        if (typeof linked !== "string")
+            return linked;
+        filePath = linked;
     }
     const segments = filePath.split("/");
     if (filePath === "" ||
@@ -40,6 +36,66 @@ export function parseCoursePath(input, courseId, origin) {
     }
     return filePath;
 }
+/** The course-file path a `quickLink.d2l?type=coursefile` link names, or why it can't be used. */
+function quickLinkFilePath(input, courseId, origin) {
+    const brightspacePath = toBrightspacePath(input, origin);
+    const link = brightspacePath === null ? null : new URL(brightspacePath, "https://placeholder.invalid");
+    if (link === null || link.pathname !== QUICKLINK_PATH || link.searchParams.get("type") !== "coursefile") {
+        return { error: "coursePath must be a course file path, a /content/enforced/ link, or a quickLink URL on this Brightspace with type=coursefile." };
+    }
+    const ou = link.searchParams.get("ou");
+    if (ou !== null && ou !== String(courseId)) {
+        return { error: `This quickLink belongs to course ${ou}, not course ${courseId}.` };
+    }
+    return link.searchParams.get("fileId") ?? "";
+}
+/**
+ * The course-file path a `/content/enforced/<course folder>/<path>` href
+ * names, an error when it names one unsafely, or null when the input is not
+ * such an href. Read from the raw text, not a parsed URL, because URL parsing
+ * would resolve a `..` (or `%2e%2e`) segment out of the course folder before
+ * it could be refused. A folder named `<ou>-...` must belong to this course.
+ */
+function enforcedFilePath(input, courseId, origin) {
+    let path = input;
+    if (!path.startsWith("/")) {
+        let link;
+        try {
+            link = new URL(path);
+        }
+        catch {
+            return null;
+        }
+        if (!origin || link.origin !== new URL(origin).origin || link.username || link.password)
+            return null;
+        path = path.slice(path.indexOf("/", path.indexOf("//") + 2));
+    }
+    if (!path.startsWith(ENFORCED_PREFIX))
+        return null;
+    // Brightspace serves a backslash in a course-file path as a folder separator
+    // (old imported courses link files as csfiles\home_dir\...), so it is read
+    // as one here, before the segments are checked.
+    const [folder, ...rest] = path.slice(ENFORCED_PREFIX.length).split(/[?#]/)[0].replace(/\\/g, "/").split("/");
+    const ou = /^(\d+)-/.exec(folder)?.[1];
+    if (ou !== undefined && ou !== String(courseId)) {
+        return { error: `This file belongs to course ${ou}, not course ${courseId}.` };
+    }
+    const segments = [];
+    for (const segment of rest) {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            return { error: "coursePath is not a valid link: it has malformed percent-encoding." };
+        }
+        // An encoded "/" would let one segment smuggle in several, ".." among them.
+        if (decoded.includes("/"))
+            return { error: "coursePath must not hide a '/' inside a single path segment." };
+        segments.push(decoded);
+    }
+    return segments.join("/");
+}
 /**
  * The course file paths a module description links through
  * `quickLink.d2l?type=coursefile`, in page order, once each. Read from the raw

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.0.12",
+  "version": "5.0.13",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",