dotnet/wpf · error · FileFormatException

SR.Resource_XpsPackageBoundaryViolation

Error message

SR.Resource_XpsPackageBoundaryViolation

What it means

During FinalizeCreation, BitmapImage enforces the XPS package boundary: if the image was parsed inside an XPS package (_xpsPackageOrigin captured at EndInit), cross-package URIs are rejected with FileFormatException (SR.Resource_XpsPackageBoundaryViolation) before any network request. This blocks XPS documents from referencing image resources outside their own package.

Solutions

  1. Make the image reference package-relative (e.g. pack://package:,,,/resources/img.png style relative URI) so it resolves inside the originating XPS package.
  2. Embed the image as a resource inside the XPS package instead of referencing an external URI.
  3. Remove the absolute/external URI and use a relative path anchored at the package root.
  4. Repackage/rebuild the XPS document with corrected resource paths.

Example fix

<!-- before: escapes the package -->
<Image Source="http://external.example.com/logo.png" />

<!-- after: package-relative resource -->
<Image Source="/resources/logo.png" />
Defensive patterns

Strategy: validation

Validate before calling

var resolved = resolvedUri.IsAbsoluteUri ? resolvedUri : new Uri(new Uri(baseUri), resolvedUri);
bool sameOrigin = packageOrigin != null &&
    (resolved.IsFile ? resolved.LocalPath.StartsWith(packageDir) : resolved.Authority == packageOrigin.Authority && resolved.AbsolutePath.StartsWith(packageOrigin.AbsolutePath));

Type guard

bool isInsidePackage(Uri origin, Uri candidate) => candidate != null && (candidate.IsFile ? candidate.LocalPath.StartsWith(origin.LocalPath, StringComparison.OrdinalIgnoreCase) : string.Equals(candidate.Authority, origin.Authority, StringComparison.OrdinalIgnoreCase) && candidate.AbsolutePath.StartsWith(origin.AbsolutePath));

Try / catch

try { img.EndInit(); }
catch (FileFormatException) when (isInsideXpsDocument) { img = LoadFallbackEmbeddedImage(); }

Prevention

When it happens

Trigger: A BitmapImage created while an XPS package context is active whose resolved UriSource points at a location outside the originating package (IsUriAllowedAgainstPackage returns false), evaluated lazily in FinalizeCreation from EndInit or OnDownloadCompleted.

Common situations: XPS documents with external image references (absolute http:// URIs or sibling-file paths) after security tightening on package boundaries; moving XPS content or shared resource dictionaries across packages; relative URIs that resolve outside the package due to incorrect base URIs.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/d05d8709dd39dded. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapImage.cs:297

            }
        }

        ///
        /// Create the unmanaged resources
        ///
        internal override void FinalizeCreation()
        {
            _bitmapInit.EnsureInitializedComplete();
            Uri uri = UriSource;
            if (_baseUri != null)
                uri = new Uri(_baseUri, UriSource);

            // Enforce XPS package boundary before any network request.
            // _xpsPackageOrigin was captured in EndInit (during the parse window).
            if (_xpsPackageOrigin != null
                && !XpsLoadingContext.IsUriAllowedAgainstPackage(_xpsPackageOrigin, uri))
            {
                throw new FileFormatException(SR.Resource_XpsPackageBoundaryViolation);
            }

            if ((CreateOptions & BitmapCreateOptions.IgnoreImageCache) != 0)
            {
                ImagingCache.RemoveFromImageCache(uri);
            }

            BitmapImage bitmapImage = CheckCache(uri);

            if (bitmapImage != null &&
                bitmapImage.CheckAccess() &&
                bitmapImage.SourceRect.Equals(SourceRect) &&
                bitmapImage.DecodePixelWidth == DecodePixelWidth &&
                bitmapImage.DecodePixelHeight == DecodePixelHeight &&
                bitmapImage.Rotation == Rotation &&
                (bitmapImage.CreateOptions & BitmapCreateOptions.IgnoreColorProfile) ==
                (CreateOptions & BitmapCreateOptions.IgnoreColorProfile)
               )

View on GitHub (pinned to 81131a70a4)