[Rodrigo Brandão (rodrigobr-msft)]

Summary

Ports attachment downloading support from the .NET Agents SDK to Python.

Changes

• Added AttachmentDownloader for standard channel attachments.
• Added M365AttachmentDownloader for Teams and Microsoft 365 Copilot.
• Supports remote, inline, authenticated, and anonymous attachment downloads.
• Added optional outbound host validation and safe localhost URL handling.
• Added outgoing audience resolution to ClaimsIdentity.
• Added filenames to InputFile.
• Added connector support for generating attachment URIs.
• Added a handling-attachments sample based on the .NET implementation.
• Added unit and end-to-end tests covering downloader routing, authentication, URL validation, failure responses, and access through state.temp.input_files.

Validation

34 focused unit tests passed

[Copilot]

Copilot review overview

🟡 Changes recommended

Redirect-based host-validation bypasses and multiple downloader correctness issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2 · 10 · 3

Open (15)

• Prevent SSRF bypass through redirects · New
• Validate attachment redirect destinations · New
• Reject HTTPS URLs without valid hostnames · New
• Preserve media type unless payload is transcoded · New
• Reject invalid content URLs instead of serializing metadata · New
• Normalize Teams channel IDs before filtering · New
• Skip identity validation for anonymous downloads · New
• Omit Authorization header without access token · New
• Preserve downloaded image media types · New
• Reject invalid remote URLs instead of treating them as inline · New
• Handle missing members in help activity handler · New
• Preserve downloaded file content type · New
• Fix misspelling in parser comment · New
• Document the InputFile filename parameter · New
• Use the correct OpenAPI sample name · New

What changed in this PR

Adds attachment downloading support to the hosting layer for standard channels, Teams, and Microsoft 365 Copilot.

Changes:

• Adds generic and M365 attachment downloaders with authentication and host validation.
• Extends attachment, identity, connector, and input-file APIs.
• Adds a handling-attachments sample plus unit and integration coverage.

File	Description
tests/​hosting_core/​connector/​test_connector_client.py	Tests attachment URI generation.
tests/​hosting_core/​authorization/​test_claims_identity.py	Tests outgoing audience resolution.
tests/​hosting_core/​app/​test_m365_attachment_downloader.py	Tests M365 downloader behavior.
tests/​hosting_core/​app/​test_attachment_downloader.py	Tests generic downloader behavior.
tests/​hosting_core/​app/​test_agent_application_file_downloaders.py	Tests downloader application integration.
test_samples/​handling_attachments/​src/​main.py	Hosts the sample application.
test_samples/​handling_attachments/​src/​agent.py	Implements attachment sample handlers.
test_samples/​handling_attachments/​src/​__init__.py	Defines the sample package.
test_samples/​handling_attachments/​requirements.txt	Lists sample dependencies.
test_samples/​handling_attachments/​README.md	Documents sample setup and usage.
test_samples/​handling_attachments/​env.TEMPLATE	Provides sample configuration variables.
libraries/​.../​connector/​mcs/​mcs_connector_client.py	Marks attachment URIs unsupported for MCS.
libraries/​.../​connector/​client/​connector_client.py	Generates escaped attachment URIs.
libraries/​.../​connector/​attachments_base.py	Extends the attachment operations protocol.
libraries/​.../​authorization/​claims_identity.py	Resolves outgoing token audiences.
libraries/​.../​app/​m365_attachment_downloader.py	Implements authenticated M365 downloads.
libraries/​.../​app/​input_file.py	Adds optional filenames to input files.
libraries/​.../​app/​attachment_downloader.py	Implements standard attachment downloads.
libraries/​.../​app/​_utils.py	Adds URL and content-type helpers.
libraries/​.../​activity/​channels.py	Adds an M365 Copilot channel constant.
libraries/​.../​activity/​attachment.py	Corrects optional attachment annotations.
dev/​integration/​tests/​downloader/​test_m365_attachment_downloader.py	Covers M365 end-to-end downloads.
dev/​integration/​tests/​downloader/​test_attachment_downloader.py	Covers generic end-to-end downloads.
dev/​integration/​tests/​downloader/​scenario.py	Defines the downloader integration scenario.
dev/​integration/​tests/​downloader/​conftest.py	Provides a local download test server.
dev/​integration/​tests/​downloader/​__init__.py	Defines the integration-test package.
changelog.md	Records the new downloader feature and sample.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

URL validation and redirect handling expose security risks, while channel routing and attachment metadata contain functional errors.

Review effort: Balanced
Findings: None

Resolved since last review (15)

• Validate attachment redirect destinations
• Prevent SSRF bypass through redirects
• Preserve downloaded file content type
• Handle missing members in help activity handler
• Reject invalid remote URLs instead of treating them as inline
• Preserve downloaded image media types
• Omit Authorization header without access token
• Skip identity validation for anonymous downloads
• Normalize Teams channel IDs before filtering
• Reject invalid content URLs instead of serializing metadata
• Preserve media type unless payload is transcoded
• Reject HTTPS URLs without valid hostnames
• Use the correct OpenAPI sample name
• Document the InputFile filename parameter
• Fix misspelling in parser comment

Previously missed (3)

In code that hasn't changed since last review

Acquire tokens only for remote downloads

libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​m365_attachment_downloader.py:86

Token acquisition happens before determining whether any attachment is remote. Consequently an inline-only M365 turn can fail because identity/provider resolution or token acquisition fails, even though inline serialization needs no authentication. Resolve the token lazily only when a remote download is attempted.

Fall back when downloadUrl is null or empty

libraries/​microsoft-agents-hosting-core/​microsoft_agents/​hosting/​core/​app/​m365_attachment_downloader.py:134

If M365 metadata contains "downloadUrl": null or an empty string, dict.get does not use its default, so the valid content_url is ignored and the metadata is serialized as inline content. Use an or fallback so absent and empty download URLs both fall back correctly.

Include the required editable-mode config setting

test_samples/​handling_attachments/​README.md:22

These editable-install commands omit the repository-required --config-settings editable_mode=compat option. Match the documented setup and scripts/dev_setup.sh:5-15; otherwise contributors can get a different editable layout from the one this repository supports.