dotnet/wpf · error · InvalidOperationException

SR.Format(SR.BamlIsNotSupportedOutsideOfApplicationResources…

Error message

SR.Format(SR.BamlIsNotSupportedOutsideOfApplicationResources)

What it means

AppModelKnownContentFactory.BamlConverterCore refuses to load BAML when isUnsafe is true, throwing InvalidOperationException with SR.BamlIsNotSupportedOutsideOfApplicationResources. BAML may only be consumed from trusted application resources; partial-trust ('unsafe') contexts are explicitly blocked. This is a deliberate security boundary of the WPF application model, not an internal bug.

Solutions

1. Run the application with full trust (adjust ClickOnce/XBAP permission set) so the BAML load is not flagged unsafe.
2. Ship the content as loose XAML or a compiled assembly loaded through a supported mechanism instead of BAML in this context.
3. Restructure navigation so BAML pages are only loaded from application resources in a fully trusted app domain.

try { NavigateTo(bamlUri); }
catch (InvalidOperationException) { /* fall back to loose XAML via XamlReader */ }

When it happens

Trigger: Navigating (e.g. NavigationWindow/Frame, Application.LoadComponent path) to a BAML resource while running in a partial-trust/sandboxed context that flags the load as unsafe.

Common situations: XBAP or partial-trust ClickOnce deployments attempting to load compiled BAML pages; browser-hosted WPF navigating to internal resource URIs under security restrictions.

Related errors

• Can't Assign to Known Type attributes
• Could not find prefix for type
• Found unexpected Xmlns BAML record
• NotImplementedException
• Resource_XpsPackageBoundaryViolation

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/bdfa02ceb24dd013. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/PresentationFramework/MS/Internal/AppModel/AppModelKnownContentFactory.cs:37

{
    // !!!! Note: Those methods are registered as MimeObjectFactory.StreamToObjectFactoryDelegate. The caller expects the 
    // delgate to close stream. 
    internal static class AppModelKnownContentFactory
    {
        // <summary>
        // Creates an object instance from a Baml stream and it's Uri
        // </summary>
        internal static object BamlConverter(Stream stream, Uri baseUri, bool canUseTopLevelBrowser, bool sandboxExternalContent, bool allowAsync, bool isJournalNavigation, out XamlReader asyncObjectConverter)
        {
            return BamlConverterCore(stream, baseUri, canUseTopLevelBrowser, sandboxExternalContent, allowAsync, isJournalNavigation, out asyncObjectConverter, false);
        }

        internal static object BamlConverterCore(Stream stream, Uri baseUri, bool canUseTopLevelBrowser, bool sandboxExternalContent, bool allowAsync, bool isJournalNavigation, out XamlReader asyncObjectConverter, bool isUnsafe)
        {
            asyncObjectConverter = null;
            if (isUnsafe)
            {
                throw new InvalidOperationException(SR.Format(SR.BamlIsNotSupportedOutsideOfApplicationResources));
            }
            // If this stream comes from outside the application throw
            //
            if (!BaseUriHelper.IsPackApplicationUri(baseUri))
            {
                throw new InvalidOperationException(SR.BamlIsNotSupportedOutsideOfApplicationResources);
            }

            // If this stream comes from a content file also throw
            Uri partUri = PackUriHelper.GetPartUri(baseUri);
            string partName, assemblyName, assemblyVersion, assemblyKey;
            BaseUriHelper.GetAssemblyNameAndPart(partUri, out partName, out assemblyName, out assemblyVersion, out assemblyKey);
            if (ContentFileHelper.IsContentFile(partName))
            {
                throw new InvalidOperationException(SR.BamlIsNotSupportedOutsideOfApplicationResources);
            }

            ParserContext pc = new ParserContext

View on GitHub (pinned to 81131a70a4)