dotnet/wpf · error · FileFormatException

Resource_XpsPackageBoundaryViolation

Error message

Resource_XpsPackageBoundaryViolation

What it means

BitmapDownload.BeginDownload validates each requested URI against the decoder's XPS package origin (XpsLoadingContext.IsUriAllowedAgainstPackage) to prevent fetching resources outside the current package (SSRF). If the URI is not allowed, a FileFormatException with Resource_XpsPackageBoundaryViolation is thrown before starting the download thread.

Solutions

  1. Replace external image URIs with relative URIs to parts embedded in the same XPS package.
  2. Embed the remote images into the package at authoring time.
  3. Pre-download and locally host required images before entering the XPS loading context.
  4. Catch FileFormatException and substitute a placeholder image for disallowed URIs.

Example fix

// before
BitmapDownload.BeginDownload(uri: new Uri("https://cdn.example.com/a.png"), ...); // blocked during XPS load
// after
BitmapDownload.BeginDownload(uri: relativePackUriToEmbeddedPart, ...);
Defensive patterns

Strategy: validation

Validate before calling

static bool IsSafeForPackage(Uri candidate, Uri packageOrigin) =>
    candidate == null || !candidate.IsAbsoluteUri ||
    (packageOrigin != null && candidate.Host == packageOrigin.Host);

Type guard

bool DownloadAllowed(Uri uri, Uri xpsOrigin) => XpsLoadingContext.IsUriAllowedAgainstPackage(xpsOrigin, uri);

Try / catch

try { BitmapDownload.BeginDownload(uri, callback, ...); }
catch (FileFormatException) { callback(null); // render placeholder }

Prevention

When it happens

Trigger: Asynchronous bitmap download (BitmapDownload.BeginDownload) of an image URI that points outside the package associated with the decoder's xpsOrigin, e.g. remote http(s) URLs or absolute URIs referenced by XPS content during deferred/async loading.

Common situations: XPS documents with external image links resolved lazily on the download thread; security-hardened viewers blocking cross-package fetches; content generated with absolute CDN image URLs inside XPS.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/81b261dfbc634ede. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapDownload.cs:86

        internal static void BeginDownload(
            BitmapDecoder decoder, 
            Uri uri, 
            RequestCachePolicy uriCachePolicy, 
            Stream stream
            )
        {
            if (uri != null && uri.IsAbsoluteUri)
            {
                Uri xpsOrigin = decoder != null ? decoder._xpsPackageOrigin : XpsLoadingContext.ActivePackageUri;
                
                // Security: When loading XPS content, block image URIs that escape
                // the current package to prevent SSRF. Check before any side effects
                // (thread start, temp file creation, URI table insertion).
                // Uses the decoder's stored origin to handle deferred loading on
                // the dedicated download thread where AsyncLocal doesn't flow.
                if (!XpsLoadingContext.IsUriAllowedAgainstPackage(xpsOrigin, uri))
                {
                    throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);
                }
            }

            lock (_syncLock)
            {
                if (!_thread.IsAlive)
                {
                    _thread.IsBackground = true;
                    _thread.Start();
                }
            }

            QueueEntry entry;

            // If there is already a download for this uri, just add the decoder to the list
            if (uri != null)
            {
                lock (_syncLock)

View on GitHub (pinned to 81131a70a4)