{"record":{"id":"a0ddd9fd5d1adef7","repo":"dotnet/wpf","slug":"sr-invalid-uri","errorCode":null,"errorMessage":"SR.Invalid_URI","messagePattern":"SR\\.Invalid_URI","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/Shared/MS/Internal/SecurityHelper.cs","lineNumber":107,"sourceCode":"              string uriString = BindUriHelper.UriToString( uri ) ;\n              //\n              // special case the condition if file is on local machine or UNC to ensure that content with mark of the web\n              // does not yield with an internet zone result\n              //\n              if (uri.IsFile)\n              {\n                  pSec.MapUrlToZone( uriString, out targetZone, MS.Win32.NativeMethods.MUTZ_NOSAVEDFILECHECK );\n              }\n              else\n              {\n                  pSec.MapUrlToZone( uriString, out targetZone, 0 );\n              }\n              //\n              // This is the condition for Invalid zone\n              //\n              if (targetZone < 0)\n              {\n                throw new SecurityException( SR.Invalid_URI );\n              }\n              pSec = null;\n              curSecMgr = null;\n              return targetZone;\n        }\n#endif\n\n#if DRT\n        /// <remarks> The LinkDemand on Marshal.SizeOf() was removed in v4. </remarks>\n        internal static int SizeOf(Type t)\n        {\n            return Marshal.SizeOf(t);\n        }\n#endif\n\n#if DRT\n        internal static int SizeOf(Object o)\n        {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/Shared/MS/Internal/SecurityHelper.cs#L89-L125","documentation":"SecurityHelper's zone-determination code queries the security manager for the URL's Internet Explorer security zone; if the resolved zone is negative (Invalid zone) it throws SecurityException(SR.Invalid_URI). The library cannot map the URI to a known trust zone, so it refuses to proceed with zone-based security decisions.","triggerScenarios":"Calling the zone-resolution helper (under the #if conditional runtime path) with a URI whose zone cannot be determined: malformed/unrecognized URL schemes, file paths outside mapped zones, or when the URL security manager returns no zone mapping.","commonSituations":"Launching WPF XBAP/ClickOnce-style content with unusual custom schemes (e.g. myapp://) or mangled URLs; enterprise machines where IE zone configuration/URLMON zone mappings are broken or restricted.","solutions":["Use a well-formed absolute http/https/file URI with a recognized scheme.","Verify the URL parses with System.Uri and check its SchemeName before passing it to zone resolution.","Restore/review Internet Explorer Internet Options security zone settings (or URLMON zone mapping) on the machine.","Catch SecurityException around zone resolution and fail gracefully with a user-facing 'unsupported URL' message."],"exampleFix":"// before\nint zone = SecurityHelper.GetUrlSecurityZone(userSuppliedUrl);\n// after\nif (!Uri.TryCreate(userSuppliedUrl, UriKind.Absolute, out var uri) ||\n    (uri.Scheme != Uri.UriSchemeHttp && uri.Scheme != Uri.UriSchemeHttps && uri.Scheme != Uri.UriSchemeFile))\n    throw new ArgumentException($\"URL scheme is not recognized: {userSuppliedUrl}\");\nint zone = SecurityHelper.GetUrlSecurityZone(uri);","handlingStrategy":"try-catch","validationCode":"if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))\n    throw new ArgumentException($\"Malformed URL: {url}\");\nif (uri.Scheme != Uri.UriSchemeHttp && uri.Scheme != Uri.UriSchemeHttps && uri.Scheme != Uri.UriSchemeFile)\n    throw new ArgumentException($\"Unsupported URL scheme: {uri.Scheme}\");","typeGuard":"static bool IsKnownScheme(Uri u) =>\n    u.Scheme == Uri.UriSchemeHttp || u.Scheme == Uri.UriSchemeHttps || u.Scheme == Uri.UriSchemeFile;","tryCatchPattern":"try\n{\n    int zone = SecurityHelper.GetUrlSecurityZone(uri);\n}\ncatch (SecurityException ex)\n{\n    // zone could not be determined; treat as untrusted\n    logger.LogWarning(ex, \"Could not resolve security zone for {Url}\", uri);\n    return ZoneUntrusted;\n}","preventionTips":["Only pass absolute URIs with standard schemes to zone resolution.","Validate user-entered URLs with Uri.TryCreate first.","Ensure IE/URLMON security zone configuration is intact on the machine.","Fail closed: treat unresolvable zones as untrusted."],"tags":["security","uri","trust-zone"],"backgroundTag":"invalid-url","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}