{"record":{"id":"38bbaddd8d930d18","repo":"dotnet/wpf","slug":"sr-resource-xpspackageboundaryviolation-pixelshader","errorCode":null,"errorMessage":"SR.Resource_XpsPackageBoundaryViolation","messagePattern":"SR\\.Resource_XpsPackageBoundaryViolation","errorType":"exception","errorClass":"FileFormatException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Effects/PixelShader.cs","lineNumber":97,"sourceCode":"                    }\n\n                    Debug.Assert(newUri.IsAbsoluteUri);\n\n                    // Now the URI is an absolute URI.\n\n                    //\n                    // Only allow file and pack URIs.\n                    if (!newUri.IsFile && \n                        !MS.Internal.IO.Packaging.PackUriHelper.IsPackUri(newUri))\n                    {\n                        throw new ArgumentException(SR.Effect_SourceUriMustBeFileOrPack);\n                    }\n\n                    // Security: When loading XPS content, block shader URIs that\n                    // escape the current package to prevent SSRF.\n                    if (!XpsLoadingContext.IsUriAllowedInCurrentContext(newUri))\n                    {\n                        throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);\n                    }\n\n                    stream = WpfWebRequestHelper.CreateRequestAndGetResponseStream(newUri);\n                }\n\n                LoadPixelShaderFromStreamIntoMemory(stream);            \n            }\n            finally\n            {\n                stream?.Dispose();\n            }\n        }\n\n        /// <summary>\n        /// Reads the byte code for the pixel shader into a local byte array. If the stream is null, the byte array\n        /// will be empty (length 0). The compositor will use an identity shader.\n        /// </summary>\n        private void LoadPixelShaderFromStreamIntoMemory(Stream source) ","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Effects/PixelShader.cs#L79-L115","documentation":"While resolving a PixelShader's UriSource inside XPS-loaded content, the URI pointed outside the current XPS package and XpsLoadingContext.IsUriAllowedInCurrentContext returned false, so the loader throws FileFormatException(SR.Resource_XpsPackageBoundaryViolation). This is a deliberate security guard against shader URIs escaping the package (SSRF/cross-package reads).","triggerScenarios":"An XPS document contains shader markup whose URI references another package, an absolute file/http path, or any target outside the current package boundary; loading untrusted XPS content.","commonSituations":"XPS documents produced by third-party tools embedding absolute shader references; documents tampered with or crafted to probe local resources; porting content that worked before the boundary check was added.","solutions":["Re-author the XPS so the shader resource is embedded within the same package and referenced with a relative pack URI","Only load shader content from trusted, application-shipped resources instead of document-supplied URIs","Pre-process untrusted XPS to strip/replace external shader references before rendering","If you own the content pipeline, validate shader URIs at authoring time against the package boundary"],"exampleFix":"// before (inside XPS-fixed-page markup)\n<!-- UriSource=\"/ ../../otherPackage/shader.ps\" --> <!-- escapes package, throws -->\n\n// after: embed shader in the same package and reference relatively\n<!-- UriSource=\"resources/shader.ps\" -->","handlingStrategy":"validation","validationCode":"// before rendering untrusted XPS content:\nbool allowed = XpsLoadingContext.IsUriAllowedInCurrentContext(shaderUri);\nif (!allowed)\n{\n    // reject document or replace the shader reference with an app-shipped resource\n}","typeGuard":null,"tryCatchPattern":"try { LoadXpsWithShaders(document); }\ncatch (FileFormatException ex) when (ex.Message.Contains(\"boundary\"))\n{\n    // treat document as untrusted: quarantine or re-author\n}","preventionTips":["Never reference resources outside the XPS package from document markup","Embed shaders in the package with relative pack URIs","Sanitize untrusted XPS before rendering","Keep the boundary check enabled; do not bypass it"],"tags":["wpf","pixelshader","security","xps","ssrf"],"backgroundTag":"path-traversal-blocked","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}