{"record":{"id":"81b261dfbc634ede","repo":"dotnet/wpf","slug":"resource-xpspackageboundaryviolation-bitmapdownload","errorCode":null,"errorMessage":"Resource_XpsPackageBoundaryViolation","messagePattern":"Resource_XpsPackageBoundaryViolation","errorType":"exception","errorClass":"FileFormatException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapDownload.cs","lineNumber":86,"sourceCode":"        internal static void BeginDownload(\n            BitmapDecoder decoder, \n            Uri uri, \n            RequestCachePolicy uriCachePolicy, \n            Stream stream\n            )\n        {\n            if (uri != null && uri.IsAbsoluteUri)\n            {\n                Uri xpsOrigin = decoder != null ? decoder._xpsPackageOrigin : XpsLoadingContext.ActivePackageUri;\n                \n                // Security: When loading XPS content, block image URIs that escape\n                // the current package to prevent SSRF. Check before any side effects\n                // (thread start, temp file creation, URI table insertion).\n                // Uses the decoder's stored origin to handle deferred loading on\n                // the dedicated download thread where AsyncLocal doesn't flow.\n                if (!XpsLoadingContext.IsUriAllowedAgainstPackage(xpsOrigin, uri))\n                {\n                    throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);\n                }\n            }\n\n            lock (_syncLock)\n            {\n                if (!_thread.IsAlive)\n                {\n                    _thread.IsBackground = true;\n                    _thread.Start();\n                }\n            }\n\n            QueueEntry entry;\n\n            // If there is already a download for this uri, just add the decoder to the list\n            if (uri != null)\n            {\n                lock (_syncLock)","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapDownload.cs#L68-L104","documentation":"BitmapDownload.BeginDownload validates each requested URI against the decoder's XPS package origin (XpsLoadingContext.IsUriAllowedAgainstPackage) to prevent fetching resources outside the current package (SSRF). If the URI is not allowed, a FileFormatException with Resource_XpsPackageBoundaryViolation is thrown before starting the download thread.","triggerScenarios":"Asynchronous bitmap download (BitmapDownload.BeginDownload) of an image URI that points outside the package associated with the decoder's xpsOrigin, e.g. remote http(s) URLs or absolute URIs referenced by XPS content during deferred/async loading.","commonSituations":"XPS documents with external image links resolved lazily on the download thread; security-hardened viewers blocking cross-package fetches; content generated with absolute CDN image URLs inside XPS.","solutions":["Replace external image URIs with relative URIs to parts embedded in the same XPS package.","Embed the remote images into the package at authoring time.","Pre-download and locally host required images before entering the XPS loading context.","Catch FileFormatException and substitute a placeholder image for disallowed URIs."],"exampleFix":"// before\nBitmapDownload.BeginDownload(uri: new Uri(\"https://cdn.example.com/a.png\"), ...); // blocked during XPS load\n// after\nBitmapDownload.BeginDownload(uri: relativePackUriToEmbeddedPart, ...);","handlingStrategy":"validation","validationCode":"static bool IsSafeForPackage(Uri candidate, Uri packageOrigin) =>\n    candidate == null || !candidate.IsAbsoluteUri ||\n    (packageOrigin != null && candidate.Host == packageOrigin.Host);","typeGuard":"bool DownloadAllowed(Uri uri, Uri xpsOrigin) => XpsLoadingContext.IsUriAllowedAgainstPackage(xpsOrigin, uri);","tryCatchPattern":"try { BitmapDownload.BeginDownload(uri, callback, ...); }\ncatch (FileFormatException) { callback(null); // render placeholder }","preventionTips":["Use relative, in-package URIs for all XPS image resources","Embed remote images into the package during authoring","Validate every URI against the package origin before async download","Assume downloads happen off-thread where AsyncLocal context does not flow"],"tags":["wpf","xps","security","ssrf","uri"],"backgroundTag":"path-traversal-blocked","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}