brightspace-mcp-server 5.1.23 → 5.1.24

package/build/tools/get-assignments.js

@@ -23,6 +23,13 @@ function richTextHtml(field) {
     const nested = typeof field.Text === "object" && field.Text !== null ? field.Text.Html : null;
     return nested ?? field.Html ?? null;
 }
+/** The highest Score among attempts D2L has scored, or null when none has one. */
+function bestAttemptScore(attempts) {
+    const scores = (attempts ?? [])
+        .map((a) => a.Score)
+        .filter((score) => typeof score === "number");
+    return scores.length > 0 ? Math.max(...scores) : null;
+}
 /**
  * The grade types a student is actually scored on. D2L documents exactly four
  * GradeObject shapes, told apart by a string GradeType; anything else a
@@ -764,9 +771,9 @@ async function fetchCourseInventory(apiClient, courseId, baseUrl) {
             attemptsUsed: completedAttempts?.length ?? null,
             attemptsRemaining,
             attemptWarning,
-            bestScore: completedAttempts && completedAttempts.length > 0
-                ? Math.max(...completedAttempts.map((a) => a.Score ?? 0))
-                : null,
+            // An attempt awaiting manual grading carries Score null: it is not a
+            // zero, so only scored attempts count toward the best (issue #370).
+            bestScore: bestAttemptScore(completedAttempts),
             gracePeriodMinutes: quiz.SubmissionGracePeriod ?? null,
             hasPassword: Boolean(quiz.Password),
             // Additive fields, each emitted only when it has something to say.

package/build/utils/course-files.js

@@ -59,6 +59,13 @@ function quickLinkFilePath(input, courseId, origin) {
 function enforcedFilePath(input, courseId, origin) {
     let path = input;
     if (!path.startsWith("/")) {
+        // Check the raw authority before URL parsing can normalize it. The first
+        // literal slash must start the path, not occur inside a query or fragment.
+        const authorityStart = path.indexOf("//") + 2;
+        const pathStart = path.indexOf("/", authorityStart);
+        if (pathStart <= authorityStart ||
+            /[?#\\\x00-\x20\x7f]/.test(path.slice(authorityStart, pathStart)))
+            return null;
         let link;
         try {
             link = new URL(path);
@@ -68,7 +75,7 @@ function enforcedFilePath(input, courseId, origin) {
         }
         if (!origin || link.origin !== new URL(origin).origin || link.username || link.password)
             return null;
-        path = path.slice(path.indexOf("/", path.indexOf("//") + 2));
+        path = path.slice(pathStart);
     }
     if (!path.startsWith(ENFORCED_PREFIX))
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.23",
+  "version": "5.1.24",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",