{"record":{"id":"8de6358e12068129","repo":"dotnet/wpf","slug":"sr-urinotabsolute","errorCode":null,"errorMessage":"SR.UriNotAbsolute","messagePattern":"SR\\.UriNotAbsolute","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/ColorContext.cs","lineNumber":487,"sourceCode":"            return !(context1 == context2);\n        }\n\n        #endregion\n\n        #region Private Methods\n\n        /// <summary>\n        /// Loads color profile given by profileUri\n        /// </summary>\n        private void Initialize(Uri profileUri, bool isStandardProfileUriNotFromUser)\n        {\n            bool tryProfileFromResource = false;\n\n            ArgumentNullException.ThrowIfNull(profileUri);\n\n            if (!profileUri.IsAbsoluteUri)\n            {\n                throw new ArgumentException(SR.UriNotAbsolute, nameof(profileUri));\n            }\n\n            // Security: When loading XPS content, block color profile URIs that\n            // escape the current package to prevent SSRF. Standard system profiles\n            // (isStandardProfileUriNotFromUser == true) are always local file\n            // paths and are exempt from this check. Uses both ambient context\n            // and captured origin for defense-in-depth.\n            _xpsPackageOrigin = XpsLoadingContext.ActivePackageUri;\n            if (!isStandardProfileUriNotFromUser\n                && !XpsLoadingContext.IsUriAllowedAgainstPackage(_xpsPackageOrigin, profileUri))\n            {\n                throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);\n            }\n\n            _profileUri = profileUri;\n            _isProfileUriNotFromUser = isStandardProfileUriNotFromUser;\n\n            Stream profileStream = null;","sourceCodeStart":469,"sourceCodeEnd":505,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/ColorContext.cs#L469-L505","documentation":"ColorContext's Initialize throws ArgumentException when the supplied profileUri is not an absolute URI. The context must be able to resolve and load the profile file/package part, which requires an absolute URI; relative URIs are rejected up front (after a null check).","triggerScenarios":"new ColorContext(new Uri(\"profiles/sRGB.icc\")) or new ColorContext(new Uri(relativeString, UriKind.Relative)) — profileUri.IsAbsoluteUri is false at ColorContext.cs:487.","commonSituations":"Config files or code storing profile paths as relative paths; pack URIs built without the pack:// scheme; string-to-Uri conversion defaulting to RelativeKind.","solutions":["Build an absolute URI: new Uri(new Uri(AppContext.BaseDirectory), relativePath) or use an absolute pack URI (pack://application:,,,/Profiles/x.icc).","Specify UriKind.Absolute when constructing from a string with a full path.","Guard with profileUri.IsAbsoluteUri before constructing the ColorContext and resolve relative paths first."],"exampleFix":"// before\nvar ctx = new ColorContext(new Uri(\"Profiles/sRGB.icc\")); // ArgumentException\n// after\nvar abs = new Uri(new Uri(AppContext.BaseDirectory), \"Profiles/sRGB.icc\");\nvar ctx = new ColorContext(abs);","handlingStrategy":"validation","validationCode":"if (profileUri == null) throw new ArgumentNullException(nameof(profileUri));\nif (!profileUri.IsAbsoluteUri) throw new ArgumentException(\"Profile URI must be absolute\", nameof(profileUri));","typeGuard":"bool IsValidProfileUri(Uri u) => u is not null && u.IsAbsoluteUri;","tryCatchPattern":"try { var ctx = new ColorContext(profileUri); }\ncatch (ArgumentException ex) when (ex.ParamName == nameof(profileUri)) { profileUri = MakeAbsolute(profileUri); var ctx = new ColorContext(profileUri); }","preventionTips":["Always build profile URIs with UriKind.Absolute","Convert config-relative paths against a known base URI early","Use full pack:// URIs for resources embedded in assemblies"],"tags":["wpf","color-context","uri","argument"],"backgroundTag":"invalid-url-format","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}