{"record":{"id":"d05d8709dd39dded","repo":"dotnet/wpf","slug":"sr-resource-xpspackageboundaryviolation-bitmapimage","errorCode":null,"errorMessage":"SR.Resource_XpsPackageBoundaryViolation","messagePattern":"SR\\.Resource_XpsPackageBoundaryViolation","errorType":"exception","errorClass":"FileFormatException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapImage.cs","lineNumber":297,"sourceCode":"            }\n        }\n\n        ///\n        /// Create the unmanaged resources\n        ///\n        internal override void FinalizeCreation()\n        {\n            _bitmapInit.EnsureInitializedComplete();\n            Uri uri = UriSource;\n            if (_baseUri != null)\n                uri = new Uri(_baseUri, UriSource);\n\n            // Enforce XPS package boundary before any network request.\n            // _xpsPackageOrigin was captured in EndInit (during the parse window).\n            if (_xpsPackageOrigin != null\n                && !XpsLoadingContext.IsUriAllowedAgainstPackage(_xpsPackageOrigin, uri))\n            {\n                throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);\n            }\n\n            if ((CreateOptions & BitmapCreateOptions.IgnoreImageCache) != 0)\n            {\n                ImagingCache.RemoveFromImageCache(uri);\n            }\n\n            BitmapImage bitmapImage = CheckCache(uri);\n\n            if (bitmapImage != null &&\n                bitmapImage.CheckAccess() &&\n                bitmapImage.SourceRect.Equals(SourceRect) &&\n                bitmapImage.DecodePixelWidth == DecodePixelWidth &&\n                bitmapImage.DecodePixelHeight == DecodePixelHeight &&\n                bitmapImage.Rotation == Rotation &&\n                (bitmapImage.CreateOptions & BitmapCreateOptions.IgnoreColorProfile) ==\n                (CreateOptions & BitmapCreateOptions.IgnoreColorProfile)\n               )","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapImage.cs#L279-L315","documentation":"During FinalizeCreation, BitmapImage enforces the XPS package boundary: if the image was parsed inside an XPS package (_xpsPackageOrigin captured at EndInit), cross-package URIs are rejected with FileFormatException (SR.Resource_XpsPackageBoundaryViolation) before any network request. This blocks XPS documents from referencing image resources outside their own package.","triggerScenarios":"A BitmapImage created while an XPS package context is active whose resolved UriSource points at a location outside the originating package (IsUriAllowedAgainstPackage returns false), evaluated lazily in FinalizeCreation from EndInit or OnDownloadCompleted.","commonSituations":"XPS documents with external image references (absolute http:// URIs or sibling-file paths) after security tightening on package boundaries; moving XPS content or shared resource dictionaries across packages; relative URIs that resolve outside the package due to incorrect base URIs.","solutions":["Make the image reference package-relative (e.g. pack://package:,,,/resources/img.png style relative URI) so it resolves inside the originating XPS package.","Embed the image as a resource inside the XPS package instead of referencing an external URI.","Remove the absolute/external URI and use a relative path anchored at the package root.","Repackage/rebuild the XPS document with corrected resource paths."],"exampleFix":"<!-- before: escapes the package -->\n<Image Source=\"http://external.example.com/logo.png\" />\n\n<!-- after: package-relative resource -->\n<Image Source=\"/resources/logo.png\" />","handlingStrategy":"validation","validationCode":"var resolved = resolvedUri.IsAbsoluteUri ? resolvedUri : new Uri(new Uri(baseUri), resolvedUri);\nbool sameOrigin = packageOrigin != null &&\n    (resolved.IsFile ? resolved.LocalPath.StartsWith(packageDir) : resolved.Authority == packageOrigin.Authority && resolved.AbsolutePath.StartsWith(packageOrigin.AbsolutePath));","typeGuard":"bool isInsidePackage(Uri origin, Uri candidate) => candidate != null && (candidate.IsFile ? candidate.LocalPath.StartsWith(origin.LocalPath, StringComparison.OrdinalIgnoreCase) : string.Equals(candidate.Authority, origin.Authority, StringComparison.OrdinalIgnoreCase) && candidate.AbsolutePath.StartsWith(origin.AbsolutePath));","tryCatchPattern":"try { img.EndInit(); }\ncatch (FileFormatException) when (isInsideXpsDocument) { img = LoadFallbackEmbeddedImage(); }","preventionTips":["Keep all image references relative to the XPS package root.","Embed external images into the package at authoring time.","Audit XPS documents for absolute http/file image URIs before deploying.","Test XPS rendering in restricted-trust contexts."],"tags":["wpf","imaging","xps","security","package-boundary"],"backgroundTag":"path-traversal-blocked","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}