Repository navigation
Fix potential issues in WPF Native Code - #11835
Merged
Merged
Conversation
…struction count mismatch When a D3DSIO_NOP is followed by a token with the high bit set, the first-pass generic parameter counting would consume it as a parameter, but the second pass NOP handler treats it as a new instruction. This causes an instruction count mismatch and OOB write. Guard against this by rejecting shaders where NOP is followed by a token with bit 31 set (which indicates a parameter token that NOP should not have). ---- #### AI description (iteration 1) #### PR Classification Security bug fix to prevent an out-of-bounds write vulnerability caused by instruction count mismatch in pixel shader processing. #### PR Summary Adds validation for NOP (no-operation) instructions in the pixel shader translator to prevent malformed tokens from causing instruction count mismatches and potential out-of-bounds writes. - `pstrans.cpp`: Added token validation after D3DSIO_NOP instructions to detect and reject invalid parameter tokens (tokens with high bit set), which would be incorrectly consumed as parameters in the first pass but treated as separate instructions in the second pass, causing OOB write vulnerabilities. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
Change m_currentOffset and related offset fields from int to size_t to prevent 32-bit integer overflow when processing glyph runs with large outline geometry. Add bounds check in Close() to reject geometry exceeding INT_MAX bytes before allocation. A crafted XPS with 65535 high-complexity glyphs could overflow the signed int offset counter, causing an undersized heap allocation followed by out-of-bounds writes in the memcpy loop. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reject geometry that would exceed INT_MAX before incrementing m_currentOffset, using subtraction pattern safe on both 32-bit and 64-bit builds. Remove redundant Close() guard since overflow is now prevented at each increment site. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…sCheckProtectionDisabled()
…overflow protection in TrueType subsetter This PR adds overflow protection guards to the TrueType font subsetter to prevent potential out-of-bounds reads/writes during CMap table and Sbit (embedded bitmap) processing. ---- Security bug fix to add bounds checking and overflow protection in the TrueType font subsetter. This PR adds comprehensive bounds checking and overflow protection to the TrueType subsetter to prevent heap buffer overflows when processing malformed fonts. The changes introduce a new AppContext switch to control CMap and Sbit overflow protection and add validation checks throughout the font processing pipeline. - **`ttftable.cpp`**: Added bounds checking for CMap Format 4 and Format 12 tables to prevent integer overflow and out-of-bounds writes, including validation against Unicode maximum range (U+10FFFF) and uint16/uint32 wraparound protection - **`modsbit.cpp`**: Added overflow protection in sbit glyph index loops to prevent uint16 wraparound and validate glyph index ranges - **`modtable.cpp`**: Added validation for hdmx, VDMX, LTSH, and kern table record counts against actual table lengths to prevent heap buffer overflows - **`truetype.cpp` and `ttf_safe_checks.h`**: Introduced new `g_fCmapAndSbitOverflowProtectionEnabled` global flag and `CMAP_SAFE_CHECKS_ENABLED()` macro, initialized from AppContext switch `Switch.MS.Internal.TtfDelta.DisableCmapAndSbitOverflowProtection` - **`CoreAppContextSwitches.cs` and `AppContextDefaultValues.cs`**: Added new AppContext switch `DisableCmapAndSbitOverflowProtection` (default: false, meaning protection is enabled) <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
…credentials security fixes Port XPS/printing SSRF & default-credentials security fixes ---- #### AI description (iteration 1) #### PR Classification Security bug fix porting XPS/printing SSRF and default-credentials security mitigations from another branch. #### PR Summary This PR adds two new security enforcement mechanisms to prevent credential leakage and package boundary violations in XPS document processing. - `DefaultCredentialsZonePolicy.cs`: Implements zone-based credential policy to prevent automatic NTLM/Kerberos/Negotiate credentials from being sent to untrusted URIs (Internet/Untrusted zones), with IP-based pre-checks for loopback/RFC1918 addresses - `XpsLoadingContext.cs`: Enforces XPS package boundary restrictions using AsyncLocal context tracking to prevent loading resources from outside the current XPS package, blocking SSRF attacks via pack:// URI validation <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->
dotnet-policy-service
Bot
added
the
PR
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens several WPF native and managed code paths against security issues (credential leakage, SSRF/package-escape, stack overflow/DoS, and multiple native bounds/overflow conditions), aligning behavior with security-zone and XPS containment expectations.
Changes:
- Gates default-credential (NTLM/Negotiate) usage based on URL security zone, and adds coverage tests for the new policy.
- Introduces a unified XPS package-boundary enforcement mechanism and applies it across XPS-related resource loading paths (images, fonts, shaders, color profiles, dictionaries, pages).
- Adds targeted bounds/overflow protections in WpfGfx shader parsing, glyph geometry building, TrueType subsetter code, and printing DEVMODE handling.
Reviewed changes
Copilot reviewed 75 out of 75 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Microsoft.DotNet.Wpf/tests/UnitTests/PresentationCore.Tests/MS/Internal/AppModel/DefaultCredentialsZonePolicyTests.cs | Adds unit/integration coverage for zone-based default-credential policy behavior. |
| src/Microsoft.DotNet.Wpf/src/WpfGfx/core/resources/GlyphRunGeometrySink.h | Switches geometry offsets to size_t to reduce overflow risk. |
| src/Microsoft.DotNet.Wpf/src/WpfGfx/core/resources/GlyphRunGeometrySink.cpp | Adds size guards and safer casts for geometry sizing/offset tracking. |
| src/Microsoft.DotNet.Wpf/src/WpfGfx/core/fxjit/PixelShader/pstrans.cpp | Adds bounds-check mitigation for malformed NOP token streams. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/System/Xaml/Parser/MePullParser.cs | Adds markup-extension nesting depth guard + switch-controlled opt-out. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/System/Xaml/MS/Impl/XamlAppContextSwitches.cs | Introduces AppContext switch plumbing for System.Xaml security guard. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/System/Xaml/Context/XamlParserContext.cs | Tracks markup-extension parsing depth on the parser context. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.zh-Hant.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.zh-Hans.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.tr.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.ru.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.pt-BR.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.pl.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.ko.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.ja.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.it.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.fr.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.es.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.de.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/xlf/Strings.cs.xlf | Adds localized entry for new depth-limit parse exception. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/Strings.resx | Adds the new depth-limit exception string. |
| src/Microsoft.DotNet.Wpf/src/System.Xaml/Resources/ExceptionStringTable.txt | Adds the new depth-limit exception entry. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/src/InteropPrinterInfo.cpp | Moves DEVMODE extraction inline to enforce bounded reads. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/src/InteropPrinterHandler.cpp | Tracks SafeMemoryHandle allocation byte-count for bounds computation. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/src/InteropJobInfo.cpp | Adds bounded DEVMODE handling and disables unsafe delegate path. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/src/InteropDevMode.cpp | Implements DEVMODE length validation + “bytes available” computation. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/inc/PrintingSwitches.h | Adds AppContext kill switch for DEVMODE validation. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/inc/InteropPrinterInfo.hpp | Removes unused GetDeviceMode declaration. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/inc/InteropPrinterHandler.hpp | Adds _byteCount field to SafeMemoryHandle. |
| src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/inc/InteropDevMode.hpp | Updates DeviceMode API to require bounds and exposes bound helper. |
| src/Microsoft.DotNet.Wpf/src/ReachFramework/Packaging/XpsDocument.cs | Sets/clears ambient XPS package context during .fdseq load. |
| src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/ResourceDictionary.cs | Enforces XPS package boundary for ResourceDictionary Source. |
| src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/XPSS0ValidatingLoader.cs | Establishes ambient XPS context + uses it for containment enforcement. |
| src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/PageContentAsyncResult.cs | Captures FileFormatException during async page load. |
| src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/PageContent.cs | Enforces same-package URIs when loading pages from XPS. |
| src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/Glyphs.cs | Enforces same-package URIs for XPS font references. |
| src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/DocumentReference.cs | Enforces same-package URIs for XPS document references. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/MediaPlayerState.cs | Adds zone-policy gating for HTTP(S) media in native pipeline. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/LateBoundBitmapDecoder.cs | Captures XPS package origin for deferred bitmap decode. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapImage.cs | Captures XPS origin and enforces package boundary before fetch. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapDownload.cs | Enforces XPS package boundary before starting downloads. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Imaging/BitmapDecoder.cs | Enforces containment early (before cache) and stores XPS origin. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/Effects/PixelShader.cs | Enforces XPS package boundary for shader URI loads. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/Windows/Media/ColorContext.cs | Enforces XPS package boundary for non-system color profiles. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/System/AppContextDefaultValues.cs | Defines defaults for new security AppContext switches. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.zh-Hant.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.zh-Hans.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.tr.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.ru.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.pt-BR.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.pl.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.ko.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.ja.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.it.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.fr.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.es.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.de.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/xlf/Strings.cs.xlf | Adds localized entry for package-boundary violation error. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/Resources/Strings.resx | Adds the package-boundary violation error string. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/PresentationCore.csproj | Includes new internal security helper source files. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/XpsLoadingContext.cs | Adds unified ambient/origin/explicit package-boundary enforcement. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/WpfWebRequestHelper.cs | Gates UseDefaultCredentials via zone policy + documents behavior. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/IO/Packaging/ByteRangeDownloader.cs | Avoids attaching default creds unless allowed by zone policy. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/FontCache/FontSource.cs | Enforces XPS containment + zone-gated default credentials in PackWebRequest path. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/CoreAppContextSwitches.cs | Adds new AppContext switches for the introduced security gates. |
| src/Microsoft.DotNet.Wpf/src/PresentationCore/MS/internal/AppModel/DefaultCredentialsZonePolicy.cs | Implements URL-zone-based decision for sending default credentials. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/main.cpp | Adds global switch backing for new cmap/sbit overflow protections. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttftable.cpp | Adds cmap parsing bounds/overflow protections. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttfdelta.cpp | Adds wraparound prevention in subset loops. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/ttf_safe_checks.h | Introduces new native switch macro for cmap/sbit overflow protection. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modtable.cpp | Adds additional bounds validation in several TT table modification paths. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modsbit.cpp | Adds wraparound/bounds protections in sbit processing. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modglyf.cpp | Adds wraparound prevention in glyph loop. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/TtfDelta/modcmap.cpp | Adds wraparound prevention in cmap format loop. |
| src/Microsoft.DotNet.Wpf/src/DirectWriteForwarder/CPP/TrueTypeSubsetter/truetype.cpp | Initializes new AppContext-driven native safety switch for cmap/sbit protections. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dipeshmsft
approved these changes
Aug 12, 2026
himgoyalmicro
added a commit
that referenced
this pull request
Oct 14, 2026
* Merged PR 65032: [release/9.0] Restrictive-XAML/XPS integrity and hyperlink navigation security fixes - **Restrictive XAML:** block untrusted URI fetches and unsafe navigation targets in RestrictiveXamlXmlReader, WpfXamlLoader, XamlReader (new RestrictiveXamlContext helper for IsUnsafe taint tracking). - **Hyperlink navigation:** propagate IsUnsafe taint through NavigationService to prevent bypass of restrictive XAML checks via hyperlink navigation. - **XPS package integrity:** enforce full element/prefix coverage and cryptographic Signature@Id binding in XpsDigitalSignature, XpsFixedDocumentReaderWriter, XpsFixedDocumentSequenceReaderWriter (new ReachAppContextSwitches for compat opt-outs). - **TrueType subsetter:** add font security protection switch (g_fFontSecurityProtectionEnabled) honored in truetype.h. - **XamlPullParser:** add a nesting-depth guard to prevent unbounded recursion. - **DefaultCredentialsZonePolicy:** stop caching positive DNS resolution decisions. - **New AppContext compatibility switches** (default off = secure): Switch.System.Windows.Markup.OptOutOfRestrictiveXamlUriBlock, Switch.System.Windows.Markup.OptOutOfNavigationTypeRestrictiveXamlBlock, Switch.System.Windows.Xps.OptOutOfPageSignatureCoverageEnforcement, Switch.System.Windows.Xps.OptOutOfSignatureIdBindingVerification, Switch.MS.Internal.TtfDelta.DisableFontSecurityProtection. ---- Security hardening release addressing multiple vulnerabilities in XAML/XPS processing, hyperlink navigation, credential leakage via DNS rebinding, and font parsing. This PR implements comprehensive security fixes for WPF 9.0, addressing critical vulnerabilities in restrictive XAML loading, XPS digital signature validation, hyperlink navigation security, DNS rebinding attacks, and font subsetting buffer overflows. - `DefaultCredentialsZonePolicy.cs`: Implements fail-closed DNS result caching (negative results only) with TTL expiration to prevent credential leakage from DNS rebinding attacks - `NavigationService.cs`: Expands restrictive XAML reader enforcement to all XPS-originated navigation and navigation from restrictively-loaded content via logical tree traversal - `XpsDigitalSignature.cs`: Adds cryptographic binding verification for Signature@Id to prevent signature spoofing attacks, with new opt-out switch - `RestrictiveXamlXmlReader.cs`: Blocks non-pack absolute URIs and UNC paths on Uri/ImageSource properties to prevent external resource fetching from untrusted XAML - `modcmap.cpp` and `mtxcalc.cpp`: Fixes heap buffer over-read vulnerabilities in TrueType cmap Format 6 processing and composite glyph parsing with bounds validation <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> * Merged PR 64002: [release/9.0] Fix pixel-shader OOB read/write in CPSTrans::Initialize Backport of the .NET 8.0 pixel-shader memory-safety fix (PR 63617, MSRC 127649 + MSRC 130198) to release/9.0. Guards pass-1/pass-2 disagreement in DEF/DEFI/DEFB and DCL handling and bounds the parameter-token skip loop in CPSTrans::Initialize, all gated behind WpfGfxSwitches::IsWpfGfxBoundsCheckProtectionDisabled(). ---- #### AI description (iteration 1) #### PR Classification Security bug fix to prevent out-of-bounds (OOB) read and write vulnerabilities in the pixel shader translation code. #### PR Summary This PR addresses security vulnerabilities (MSRC 127649, MSRC 130198) by adding bounds checking throughout the pixel shader bytecode parsing in `CPSTrans::Initialize` to prevent buffer overruns during instruction array construction and token stream processing. - Added bounds checks in the second pass to prevent instruction array overruns and ensure room for the END record - Fixed parameter token loop to validate against bytecode buffer end, preventing OOB reads when token stream lacks D3DPS_END terminator - Fixed `D3DSIO_DCL` instruction handling to always consume register tokens, ensuring first and second pass synchronization - Added default cases for constant definition instructions (`D3DSIO_DEF`, `D3DSIO_DEFI`, `D3DSIO_DEFB`) to advance token pointer consistently between passes, preventing allocation mismatches <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> * Merged PR 63406: [.NET 9.0] Fix destination-side integer overflow in CD3DGlyphBank::RectFillAlpha (MSRC 31000000667690) Fix destination-side integer overflow in CD3DGlyphBank::RectFillAlpha (MSRC 31000000667690) The hardware glyph-bank copy computed its destination row pointers using 32-bit `lockedRect.Pitch * coordinate` products. Attacker-controlled XPS Glyphs coordinates can drive `srcRect.top` / `y` into the millions, so the product exceeds INT32 range and wraps; after sign extension the destination pointer lands ~4 GiB away from the locked temporary surface. The following memset/memcpy then writes out of bounds, terminating the WPF renderer process with 0xC0000005 (denial of service). PR #11642 previously widened only the source-side products to INT64 and left the destination-side products at 32-bit. This change widens every destination `lockedRect.Pitch` product to INT64 - the `pDst00` base plus all four row loops (top edge, real data, degenerate, bottom edge) - gated behind the same WpfGfxSwitches::IsWpfGfxBoundsCheckProtectionDisabled() kill-switch used for the source side, so both halves revert together when the mitigation is disabled. Co-authored-by: Copilot ---- #### AI description (iteration 1) #### PR Classification Security bug fix addressing an integer overflow vulnerability in glyph rendering code that could lead to out-of-bounds memory writes. #### PR Summary This PR fixes a critical integer overflow vulnerability in the CD3DGlyphBank::RectFillAlpha function where attacker-controlled glyph coordinates could cause pointer arithmetic to wrap past INT32 range, resulting in out-of-bounds memory writes. - `d3dglyphbank.cpp`: Added bounds checking validation to verify the destination byte range stays within the locked temporary surface before writing - `d3dglyphbank.cpp`: Converted pointer arithmetic from 32-bit to 64-bit integers (INT64) for all `lockedRect.Pitch * y` calculations to prevent overflow when computing destination row pointers - `d3dglyphbank.cpp`: Implemented configurable protection via `WpfGfxSwitches::IsWpfGfxBoundsCheckProtectionDisabled()` to allow disabling the fix if needed while preserving legacy behavior <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> * Merged PR 64677: [.NET9.0] Fix XPS package-boundary rejection for pack:// package identities ## Summary Fixes a regression introduced by the August 2026 XPS same-package boundary enforcement (#11835). Unchanged WPF apps that register an in-memory XPS package in `PackageStore`/`XpsDocument` using a `pack://` scheme identity crash when reading the document - same-package images and fonts are wrongly rejected as "outside the current XPS package". ## Root cause `XpsLoadingContext.IsSamePackageUri` normalizes the origin package identity via `PackUriHelper.GetPackageUri(packageOrigin)`. That method's behavior depends on the identity's scheme: - Non-`pack` schemes (e.g. `xpspack://`) -> throws `ArgumentException` ("URI must contain pack:// scheme"), which the inner `catch` handled by falling back to comparing the identity as-is. - The `pack://` scheme -> `GetPackageUri` reaches `new Uri(...)` on the unescaped authority (`memorystream.xps`), and the underlying `System.Uri` constructor throws **`UriFormatException`**, which was **not** caught. The uncaught `UriFormatException` escaped to the method's outer catch, which returns `false` (fail-closed). Every same-package resource then threw `FileFormatException(Resource_XpsPackageBoundaryViolation)`, terminating the process with an unhandled exception. ## Fix Broaden the origin-normalization fallback to also catch `UriFormatException` and `InvalidOperationException`, matching the exception set the method's outer catch already anticipates. A `pack://` identity now falls back to identity comparison exactly like the working `xpspack://` path. Security is unchanged: the widened handling applies only to parsing the **origin** (the trusted package the host app opened). The **resource** URI path is untouched - scheme must be `pack`, `application:`/`siteoforigin:` authorities are rejected, and the resource's package must still `.Equals` the origin package. External (`http`/`https`/`file`/UNC) and cross-package references remain blocked. ## Testing Verified end-to-end on locally built WPF bits using the DTS repro (in-memory XPS with one image), before/after the change: | Build | Result | |-------|--------| | Unpatched | Crash `0xE0434352`, `FileFormatException` (boundary violation) | | Patched | `Completed successfully. Pages: 1`, exit 0 | Also confirmed the boundary still holds after the fix: - same-package `pack://` -> allowed - same-package `xpspack://` -> allowed - external `http://` -> blocked - cross-package `pack://` -> blocked Reproduced on .NET Framework 3.5/4.7.2/4.8/4.8.1 and .NET 8 / 9 / 10. ---- #### AI description (iteration 1) #### PR Classification Bug fix to resolve a regression in XPS package-boundary enforcement that caused print preview failures when XPS documents used bare `pack://` URIs as PackageStore identities. #### PR Summary Fixes a security boundary check that incorrectly rejected same-package XPS resources when the package identity used a bare `pack://` scheme, causing unhandled exceptions during print preview. The fix adds additional exception handlers to properly ... * Fixup test references in build * Fixing Build --------- Co-authored-by: Maria Manolova (INFRAGISTICS INC) <b-mmanolova@microsoft.com> Co-authored-by: Milko Venkov (INFRAGISTICS INC) <b-mvenkov@microsoft.com> Co-authored-by: Matt Mitchell (.NET) <mmitche@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #11830
Fixes #11829
Fixes #11828
Fixes #11827
Fixes #11826
Description
Fix potential issues in WPF Native Code
Microsoft Reviewers: Open in CodeFlow