{"record":{"id":"1290143ad29a6e3e","repo":"dotnet/wpf","slug":"sr-effect-sourceurimustbefileorpack","errorCode":null,"errorMessage":"SR.Effect_SourceUriMustBeFileOrPack","messagePattern":"SR\\.Effect_SourceUriMustBeFileOrPack","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Effects/PixelShader.cs","lineNumber":90,"sourceCode":"\n            try {                    \n                if (newUri != null)\n                {\n                    if (!newUri.IsAbsoluteUri)\n                    {\n                         newUri = BaseUriHelper.GetResolvedUri(BaseUriHelper.BaseUri, newUri);\n                    }\n\n                    Debug.Assert(newUri.IsAbsoluteUri);\n\n                    // Now the URI is an absolute URI.\n\n                    //\n                    // Only allow file and pack URIs.\n                    if (!newUri.IsFile && \n                        !MS.Internal.IO.Packaging.PackUriHelper.IsPackUri(newUri))\n                    {\n                        throw new ArgumentException(SR.Effect_SourceUriMustBeFileOrPack);\n                    }\n\n                    // Security: When loading XPS content, block shader URIs that\n                    // escape the current package to prevent SSRF.\n                    if (!XpsLoadingContext.IsUriAllowedInCurrentContext(newUri))\n                    {\n                        throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);\n                    }\n\n                    stream = WpfWebRequestHelper.CreateRequestAndGetResponseStream(newUri);\n                }\n\n                LoadPixelShaderFromStreamIntoMemory(stream);            \n            }\n            finally\n            {\n                stream?.Dispose();\n            }","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Effects/PixelShader.cs#L72-L108","documentation":"PixelShader.UriSource was set to a URI that is neither a file: URI nor a pack: URI, and UriSourcePropertyChangedHook rejected it with ArgumentException(SR.Effect_SourceUriMustBeFileOrPack). The loader only supports reading shader bytecode from the file system or from a WPF pack URI.","triggerScenarios":"Assigning pixelShader.UriSource = new Uri(\"http://...\") or any scheme other than file/pack; URIs built from user config with remote or custom schemes.","commonSituations":"Downloading shaders from a web server and pointing UriSource at the http URL; relative URIs that resolve to unsupported schemes; app settings storing remote shader URLs.","solutions":["Copy the shader to a local file (or embed it as a pack Resource/Content) and reference it via file:/pack: URI","Download the remote shader to disk first, then set UriSource to the local path","Use SetStreamSource(Stream) with the byte stream instead of UriSource","Validate the URI scheme before assignment: uri.IsFile || PackUriHelper.IsPackUri(uri)"],"exampleFix":"// before\nshader.UriSource = new Uri(\"https://cdn.example.com/shader.ps\", UriKind.Absolute); // throws\n\n// after\nFile.WriteAllText(localPath, downloadedShader); // or ship as pack resource\nshader.UriSource = new Uri(localPath, UriKind.Absolute); // file: URI","handlingStrategy":"validation","validationCode":"static void ValidateShaderUri(Uri uri)\n{\n    if (uri == null) throw new ArgumentNullException(nameof(uri));\n    bool ok = uri.IsFile || MS.Internal.IO.Packaging.PackUriHelper.IsPackUri(uri);\n    if (!ok) throw new ArgumentException(\"PixelShader.UriSource must be a file or pack URI\", nameof(uri));\n}","typeGuard":null,"tryCatchPattern":"try { shader.UriSource = uri; }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"file or pack\"))\n{\n    // copy resource locally or use SetStreamSource instead\n}","preventionTips":["Ship shaders as pack Resource/Content or local files","Never point UriSource at http/https/custom-scheme URIs","For remote shaders, download to disk or use SetStreamSource","Validate URI scheme in configuration before assignment"],"tags":["wpf","pixelshader","uri","argument"],"backgroundTag":"invalid-url-format","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}