{"record":{"id":"b9a09c61e0b2f9c1","repo":"dotnet/wpf","slug":"sr-markupextensiondepthexceeded","errorCode":null,"errorMessage":"SR.MarkupExtensionDepthExceeded","messagePattern":"SR\\.MarkupExtensionDepthExceeded","errorType":"exception","errorClass":"XamlParseException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/System.Xaml/System/Xaml/Parser/MePullParser.cs","lineNumber":110,"sourceCode":"        {\n            if (_tokenizer.Token != token)\n            {\n                SetBrokenRuleString(ruleString);\n                return false;\n            }\n\n            return true;\n        }\n\n        ////////////////////////////////\n        // MarkupExtension ::= '{' TYPENAME Arguments? '}'\n        //\n        private IEnumerable<XamlNode> P_MarkupExtension(Found f)\n        {\n            if (!XamlAppContextSwitches.DisableMarkupExtensionDepthGuard &&\n                _context.MarkupExtensionDepth >= MaxMarkupExtensionDepth)\n            {\n                throw new XamlParseException(\n                    _tokenizer,\n                    SR.Format(SR.MarkupExtensionDepthExceeded, MaxMarkupExtensionDepth));\n            }\n\n            _context.MarkupExtensionDepth++;\n            try\n            {\n                // MarkupExtension ::= @'{' TYPENAME Arguments? '}'\n                if (Expect(MeTokenType.Open, \"MarkupExtension ::= @'{' Expr '}'\"))\n                {\n                    NextToken();\n\n                    // MarkupExtension ::= '{' @TYPENAME Arguments? '}'\n                    if (_tokenizer.Token == MeTokenType.TypeName)\n                    {\n                        XamlType xamlType = _tokenizer.TokenType;\n\n                        yield return Logic_StartElement(xamlType, _tokenizer.Namespace);","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/System.Xaml/System/Xaml/Parser/MePullParser.cs#L92-L128","documentation":"P_MarkupExtension guards against runaway recursion: nesting of markup extensions beyond MaxMarkupExtensionDepth throws XamlParseException(SR.MarkupExtensionDepthExceeded, depth). The guard exists to protect the parser from stack overflow on pathological or cyclic input, and can be disabled via XamlAppContextSwitches.DisableMarkupExtensionDepthGuard.","triggerScenarios":"Parsing markup extensions nested deeper than MaxMarkupExtensionDepth (via Parse or P_Value), e.g. deeply chained '{Binding {Binding {Binding ...}}}' or malicious untrusted XAML input.","commonSituations":"Untrusted XAML input with intentionally deep nesting, generated code with runaway recursive markup-extension composition, buggy string builders producing nested extensions.","solutions":["Flatten the markup-extension nesting into simpler property assignments","Reduce nesting by defining intermediate resources instead of inline nested extensions","Set XamlAppContextSwitches.DisableMarkupExtensionDepthGuard = true only for trusted input needing greater depth","Sanitize untrusted XAML before parsing"],"exampleFix":"// before\nvar val = \"{Binding {Binding {Binding ... /* hundreds deep */}}}\";\n// after\n// declare intermediate resources:\n<TextBlock Text=\"{StaticResource Inner}\"/>","handlingStrategy":"validation","validationCode":"int NestingDepth(string s)\n{\n    int depth = 0, max = 0;\n    foreach (char c in s ?? \"\")\n    {\n        if (c == '{') max = Math.Max(max, ++depth);\n        else if (c == '}') depth = Math.Max(0, depth - 1);\n    }\n    return max;\n}\n// reject if NestingDepth(input) exceeds your allowed limit","typeGuard":null,"tryCatchPattern":"try { nodes = parser.Parse(meString); }\ncatch (XamlParseException ex) when (ex.Message.Contains(\"depth\")) { /* reject/flatten this input */ }","preventionTips":["Limit nesting when generating markup extensions","Sanitize untrusted XAML before parsing","Leave the depth guard enabled unless you fully control input"],"tags":["xaml","markup-extension","recursion-limit","security"],"backgroundTag":"value-out-of-range","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}