brightspace-mcp-server 5.1.15 → 5.1.17

package/build/utils/html-attributes.js

@@ -3,15 +3,24 @@
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
  * Licensed under MIT — see LICENSE file for details.
  */
-/** Decode the character references Brightspace's HTML editor writes into attribute values. */
+/** A numeric reference as its character, or left as written when it names no code point (issue #352). */
+function codePoint(whole, code) {
+    return code <= 0x10ffff ? String.fromCodePoint(code) : whole;
+}
+const NAMED = { quot: '"', lt: "<", gt: ">", amp: "&" };
+/**
+ * Decode the character references Brightspace's HTML editor writes into
+ * attribute values, in one pass so a decoded `&` never starts another
+ * reference: `&#38;lt;` is the text `&lt;`, not `<` (issue #360).
+ */
 export function decodeEntities(value) {
-    return value
-        .replace(/&#x([0-9a-f]+);/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)))
-        .replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(parseInt(dec, 10)))
-        .replace(/&quot;/g, '"')
-        .replace(/&lt;/g, "<")
-        .replace(/&gt;/g, ">")
-        .replace(/&amp;/g, "&");
+    return value.replace(/&(?:#[xX]([0-9a-fA-F]+)|#(\d+)|(quot|lt|gt|amp));/g, (whole, hex, dec, name) => {
+        if (hex !== undefined)
+            return codePoint(whole, parseInt(hex, 16));
+        if (dec !== undefined)
+            return codePoint(whole, parseInt(dec, 10));
+        return NAMED[name];
+    });
 }
 /**
  * The attributes of every `<tag>` element in `html`, names lowercased and

package/build/utils/transcript/captions.js

@@ -26,11 +26,11 @@ function decodeEntities(text) {
             return ENTITIES[key];
         if (key.startsWith("#x")) {
             const code = Number.parseInt(key.slice(2), 16);
-            return Number.isFinite(code) && code > 0 ? String.fromCodePoint(code) : whole;
+            return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : whole;
         }
         if (key.startsWith("#")) {
             const code = Number.parseInt(key.slice(1), 10);
-            return Number.isFinite(code) && code > 0 ? String.fromCodePoint(code) : whole;
+            return Number.isFinite(code) && code > 0 && code <= 0x10ffff ? String.fromCodePoint(code) : whole;
         }
         return whole;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.15",
+  "version": "5.1.17",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",