dotnet/wpf · error · FileFormatException

Resource_XpsPackageBoundaryViolation

Error message

Resource_XpsPackageBoundaryViolation

What it means

XpsLoadingContext.EnforcePackageRelativeUri throws FileFormatException with SR.Resource_XpsPackageBoundaryViolation when a resolved URI is not an allowed package-relative URI for the parent document. This enforces XPS package boundaries: resources must reference content inside the same XPS package rather than escaping to another package or an external location.

Solutions

  1. Fix the XPS content: replace cross-package or absolute pack:// references with package-relative part URIs (e.g. /Documents/1/Pages/1.fpage).
  2. Regenerate the XPS with a conforming producer so all resource references are relative and within the same package.
  3. If intentional external references are needed, load them via supported APIs instead of embedding them in the XPS.
  4. Catch FileFormatException during XpsDocument load and report the offending part to the document author.

Example fix

// before (inside FixedPage.xaml of an XPS)
<Image Source="pack://uuid:other-package-uuid/documents/1/img.png" />
// after
<Image Source="../../Resources/img.png" />
Defensive patterns

Strategy: validation

Validate before calling

bool IsPackageRelative(Uri uri)
{
    if (!uri.IsAbsoluteUri) return true; // relative part URI is fine
    if (uri.Scheme != "pack") return false;
    // must encode the same package as the parent document
    return XpsLoadingContext.IsAllowedPackageRelativeUri(parentUri, uri);
}

Type guard

bool IsRelativePartUri(Uri u) => !u.IsAbsoluteUri || (u.IsAbsoluteUri && u.Scheme == "pack");

Try / catch

try { XpsLoadingContext.EnforcePackageRelativeUri(parentUri, resolvedUri); }
catch (FileFormatException ex)
{ throw new InvalidOperationException("XPS part references outside its package: " + resolvedUri, ex); }

Prevention

When it happens

Trigger: Loading an XPS/FixedDocument where a part's relative URI resolves to an absolute pack:// URI whose authority encodes a different XPS package, or otherwise fails IsAllowedPackageRelativeUri checks (e.g. cross-package references, invalid authority encoding).

Common situations: Hand-crafted or tool-mangled XPS files containing absolute pack URIs in FixedPage.Source or image Sources, documents merged/relocated across packages, or generated XPS with incorrectly escaped part names.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/e095eb7126618fef. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/XpsLoadingContext.cs:160

                }
                else
                {
                    return true;
                }
            }

            return IsSamePackageUri(parentUri, resolvedUri);
        }

        /// <summary>
        /// Throws <see cref="FileFormatException"/> when
        /// <see cref="IsAllowedPackageRelativeUri"/> returns false.
        /// </summary>
        internal static void EnforcePackageRelativeUri(Uri parentUri, Uri resolvedUri)
        {
            if (!IsAllowedPackageRelativeUri(parentUri, resolvedUri))
            {
                throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);
            }
        }

        /// <summary>
        /// Returns true when <paramref name="uri"/> is an absolute pack:// URI
        /// whose authority encodes a real XPS package (i.e. an escaped package
        /// file URI). Returns false for null / non-pack URIs and for the two
        /// WPF-internal pack authorities "application:" and "siteoforigin:",
        /// which are not XPS packages.
        /// </summary>
        internal static bool IsXpsPackageContext(Uri uri)
        {
            if (uri == null || !uri.IsAbsoluteUri)
            {
                return false;
            }

            if (!string.Equals(uri.Scheme, PackUriHelper.UriSchemePack, StringComparison.OrdinalIgnoreCase))

View on GitHub (pinned to 81131a70a4)