New AttachmentDownloader and M365AttachmentDownloader as implementations of InputFileDownloader interface - #604
Draft
Rodrigo Brandão (rodrigobr-msft) wants to merge 21 commits into
Draft
Rodrigo Brandão (rodrigobr-msft) wants to merge 21 commits into
Rodrigo Brandão (rodrigobr-msft) wants to merge 21 commits into
Conversation
…into users/robrandao/downloader
…into users/robrandao/downloader
Copilot started reviewing on behalf of
Rodrigo Brandão (rodrigobr-msft)
September 25, 2026 21:49
View session
InputFileDownloaders from .NETAttachmentDownloader and M365AttachmentDownloader as implementations of InputFileDownloader interface
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Redirect-based host-validation bypasses and multiple downloader correctness issues remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 2
Open (15)
Prevent SSRF bypass through redirects · New Validate attachment redirect destinations · New Reject HTTPS URLs without valid hostnames · New Preserve media type unless payload is transcoded · New Reject invalid content URLs instead of serializing metadata · New Normalize Teams channel IDs before filtering · New Skip identity validation for anonymous downloads · New Omit Authorization header without access token · New Preserve downloaded image media types · New Reject invalid remote URLs instead of treating them as inline · New Handle missing members in help activity handler · New Preserve downloaded file content type · New Fix misspelling in parser comment · New Document the InputFile filename parameter · New Use the correct OpenAPI sample name · New
What changed in this PR
Adds attachment downloading support to the hosting layer for standard channels, Teams, and Microsoft 365 Copilot.
Changes:
- Adds generic and M365 attachment downloaders with authentication and host validation.
- Extends attachment, identity, connector, and input-file APIs.
- Adds a handling-attachments sample plus unit and integration coverage.
| File | Description |
|---|---|
tests/hosting_core/connector/test_connector_client.py |
Tests attachment URI generation. |
tests/hosting_core/authorization/test_claims_identity.py |
Tests outgoing audience resolution. |
tests/hosting_core/app/test_m365_attachment_downloader.py |
Tests M365 downloader behavior. |
tests/hosting_core/app/test_attachment_downloader.py |
Tests generic downloader behavior. |
tests/hosting_core/app/test_agent_application_file_downloaders.py |
Tests downloader application integration. |
test_samples/handling_attachments/src/main.py |
Hosts the sample application. |
test_samples/handling_attachments/src/agent.py |
Implements attachment sample handlers. |
test_samples/handling_attachments/src/__init__.py |
Defines the sample package. |
test_samples/handling_attachments/requirements.txt |
Lists sample dependencies. |
test_samples/handling_attachments/README.md |
Documents sample setup and usage. |
test_samples/handling_attachments/env.TEMPLATE |
Provides sample configuration variables. |
libraries/.../connector/mcs/mcs_connector_client.py |
Marks attachment URIs unsupported for MCS. |
libraries/.../connector/client/connector_client.py |
Generates escaped attachment URIs. |
libraries/.../connector/attachments_base.py |
Extends the attachment operations protocol. |
libraries/.../authorization/claims_identity.py |
Resolves outgoing token audiences. |
libraries/.../app/m365_attachment_downloader.py |
Implements authenticated M365 downloads. |
libraries/.../app/input_file.py |
Adds optional filenames to input files. |
libraries/.../app/attachment_downloader.py |
Implements standard attachment downloads. |
libraries/.../app/_utils.py |
Adds URL and content-type helpers. |
libraries/.../activity/channels.py |
Adds an M365 Copilot channel constant. |
libraries/.../activity/attachment.py |
Corrects optional attachment annotations. |
dev/integration/tests/downloader/test_m365_attachment_downloader.py |
Covers M365 end-to-end downloads. |
dev/integration/tests/downloader/test_attachment_downloader.py |
Covers generic end-to-end downloads. |
dev/integration/tests/downloader/scenario.py |
Defines the downloader integration scenario. |
dev/integration/tests/downloader/conftest.py |
Provides a local download test server. |
dev/integration/tests/downloader/__init__.py |
Defines the integration-test package. |
changelog.md |
Records the new downloader feature and sample. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



Summary
Ports attachment downloading support from the .NET Agents SDK to Python.
Changes
AttachmentDownloaderfor standard channel attachments.M365AttachmentDownloaderfor Teams and Microsoft 365 Copilot.ClaimsIdentity.InputFile.state.temp.input_files.Validation