dotnet/wpf · error · SecurityException

SR.Invalid_URI

Error message

SR.Invalid_URI

What it means

SecurityHelper's zone-determination code queries the security manager for the URL's Internet Explorer security zone; if the resolved zone is negative (Invalid zone) it throws SecurityException(SR.Invalid_URI). The library cannot map the URI to a known trust zone, so it refuses to proceed with zone-based security decisions.

Solutions

1. Use a well-formed absolute http/https/file URI with a recognized scheme.
2. Verify the URL parses with System.Uri and check its SchemeName before passing it to zone resolution.
3. Restore/review Internet Explorer Internet Options security zone settings (or URLMON zone mapping) on the machine.
4. Catch SecurityException around zone resolution and fail gracefully with a user-facing 'unsupported URL' message.

Example fix

// before
int zone = SecurityHelper.GetUrlSecurityZone(userSuppliedUrl);
// after
if (!Uri.TryCreate(userSuppliedUrl, UriKind.Absolute, out var uri) ||
    (uri.Scheme != Uri.UriSchemeHttp && uri.Scheme != Uri.UriSchemeHttps && uri.Scheme != Uri.UriSchemeFile))
    throw new ArgumentException($"URL scheme is not recognized: {userSuppliedUrl}");
int zone = SecurityHelper.GetUrlSecurityZone(uri);

if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
    throw new ArgumentException($"Malformed URL: {url}");
if (uri.Scheme != Uri.UriSchemeHttp && uri.Scheme != Uri.UriSchemeHttps && uri.Scheme != Uri.UriSchemeFile)
    throw new ArgumentException($"Unsupported URL scheme: {uri.Scheme}");

static bool IsKnownScheme(Uri u) =>
    u.Scheme == Uri.UriSchemeHttp || u.Scheme == Uri.UriSchemeHttps || u.Scheme == Uri.UriSchemeFile;

try
{
    int zone = SecurityHelper.GetUrlSecurityZone(uri);
}
catch (SecurityException ex)
{
    // zone could not be determined; treat as untrusted
    logger.LogWarning(ex, "Could not resolve security zone for {Url}", uri);
    return ZoneUntrusted;
}

When it happens

Trigger: Calling the zone-resolution helper (under the #if conditional runtime path) with a URI whose zone cannot be determined: malformed/unrecognized URL schemes, file paths outside mapped zones, or when the URL security manager returns no zone mapping.

Common situations: Launching WPF XBAP/ClickOnce-style content with unusual custom schemes (e.g. myapp://) or mangled URLs; enterprise machines where IE zone configuration/URLMON zone mappings are broken or restricted.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• Resource_XpsPackageBoundaryViolation
• Resource_XpsPackageBoundaryViolation
• assembly
• Document PackagePart URI is not valid.
• Image_CantDealWithUri

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/a0ddd9fd5d1adef7. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/Shared/MS/Internal/SecurityHelper.cs:107

              string uriString = BindUriHelper.UriToString( uri ) ;
              //
              // special case the condition if file is on local machine or UNC to ensure that content with mark of the web
              // does not yield with an internet zone result
              //
              if (uri.IsFile)
              {
                  pSec.MapUrlToZone( uriString, out targetZone, MS.Win32.NativeMethods.MUTZ_NOSAVEDFILECHECK );
              }
              else
              {
                  pSec.MapUrlToZone( uriString, out targetZone, 0 );
              }
              //
              // This is the condition for Invalid zone
              //
              if (targetZone < 0)
              {
                throw new SecurityException( SR.Invalid_URI );
              }
              pSec = null;
              curSecMgr = null;
              return targetZone;
        }
#endif

#if DRT
        /// <remarks> The LinkDemand on Marshal.SizeOf() was removed in v4. </remarks>
        internal static int SizeOf(Type t)
        {
            return Marshal.SizeOf(t);
        }
#endif

#if DRT
        internal static int SizeOf(Object o)
        {

View on GitHub (pinned to 81131a70a4)