{"record":{"id":"e1e7255af685368f","repo":"dotnet/wpf","slug":"resource-xpspackageboundaryviolation-bitmapdecoder","errorCode":null,"errorMessage":"Resource_XpsPackageBoundaryViolation","messagePattern":"Resource_XpsPackageBoundaryViolation","errorType":"exception","errorClass":"FileFormatException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapDecoder.cs","lineNumber":252,"sourceCode":"            UnmanagedMemoryStream unmanagedMemoryStream = null;\n            SafeFileHandle safeFilehandle = null;\n\n            if (uri != null)\n            {\n                finalUri = (baseUri != null) ?\n                               System.Windows.Navigation.BaseUriHelper.GetResolvedUri(baseUri, uri) :\n                               uri;\n\n                // Security: When loading XPS content, block URIs that escape the\n                // current package to prevent SSRF (outbound HTTP/NTLM requests via\n                // attacker-controlled ImageSource attributes in XPS FixedPages).\n                // This check runs before the cache lookup so that a previously-\n                // cached external URI cannot bypass containment.\n                if (finalUri != null\n                    && finalUri.IsAbsoluteUri\n                    && !XpsLoadingContext.IsUriAllowedInCurrentContext(finalUri))\n                {\n                    throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);\n                }\n\n                if (insertInDecoderCache)\n                {\n                    if ((createOptions & BitmapCreateOptions.IgnoreImageCache) != 0)\n                    {\n                        ImagingCache.RemoveFromDecoderCache(finalUri);\n                    }\n\n                    cachedDecoder = CheckCache(\n                        finalUri,\n                        out clsId\n                        );\n                }\n            }\n\n            // try to retrieve the cached decoder\n            if (cachedDecoder != null)","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapDecoder.cs#L234-L270","documentation":"BitmapDecoder.CreateFromUriOrStream enforces XPS package containment: while an XPS document is loading, only URIs inside the current package may be resolved. If an absolute external URI is requested (a resource outside the package, potential SSRF), a FileFormatException with Resource_XpsPackageBoundaryViolation is thrown before any cache lookup.","triggerScenarios":"Creating a BitmapDecoder from an absolute http:// or file:// URI (or a pack URI referencing another package) while an XPS loading context is active, when XpsLoadingContext.IsUriAllowedInCurrentContext rejects the URI.","commonSituations":"XPS documents referencing remote images; generated XPS containing absolute external image links; security-hardened environments blocking cross-package resource fetches.","solutions":["Rewrite image references in the XPS to relative URIs pointing to parts inside the same package.","Embed the image resources into the XPS package instead of linking to external locations.","If external URIs are legitimate, resolve/load the images before entering the XPS loading context (or outside it).","Catch FileFormatException and render a placeholder for untrusted external resources."],"exampleFix":"// before\nvar dec = BitmapDecoder.Create(new Uri(\"http://cdn.example.com/img.png\"), opts, cache); // during XPS load\n// after\n// embed the image as a package part and use a relative pack URI\nvar dec = BitmapDecoder.Create(packUriOfEmbeddedPart, opts, cache);","handlingStrategy":"validation","validationCode":"static void EnsureUriInsidePackage(Uri finalUri, Uri packageBase)\n{\n    if (finalUri == null || !finalUri.IsAbsoluteUri) return;\n    if (!finalUri.AbsolutePath.StartsWith(packageBase.AbsolutePath, StringComparison.Ordinal))\n        throw new InvalidOperationException(\"URI escapes the XPS package boundary.\");\n}","typeGuard":"bool IsContained(Uri candidate) => candidate != null && (!candidate.IsAbsoluteUri || XpsLoadingContext.IsUriAllowedInCurrentContext(candidate));","tryCatchPattern":"try { decoder = BitmapDecoder.Create(uri, opts, cache); }\ncatch (FileFormatException ex) when (ex.Message.Contains(\"boundary\") || ex.Message.Contains(\"package\")) { RenderPlaceholder(); }","preventionTips":["Author XPS with relative, in-package resource URIs","Embed images into the package instead of linking to external hosts","Pre-fetch external assets before starting XPS loading","Treat any absolute http/file URI in XPS content as a security signal"],"tags":["wpf","xps","security","ssrf","uri"],"backgroundTag":"path-traversal-blocked","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}