Imagine that...
I have WPF application and many users use it.
I want to show my application users information about upcoming events.
Can I disable following insecure behavior?
I wrote following code:
My WPF Window:
<Window x:Class="MyApplication.MainWindow" xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" Title="MainWindow" Height="350" Width="525"><Grid><Grid.RowDefinitions><RowDefinition Height="Auto" /><RowDefinition Height="*" /><RowDefinition Height="*" /></Grid.RowDefinitions><Button x:Name="btnLoad" Content="_Load" Click="btnLoad_Click" /><TextBox x:Name="tbx" AcceptsReturn="True" Grid.Row="1" AcceptsTab="True" /><ContentControl x:Name="cnt" Grid.Row="2" /></Grid></Window>
And that WPF Window Code Behind:
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Windows;
using System.Windows.Markup;
namespace MyApplication
{
public partial class MainWindow : Window
{
public MainWindow()
{
InitializeComponent();
}
private void btnLoad_Click(object sender, RoutedEventArgs e)
{
cnt.Content = string.Empty;
if (string.IsNullOrEmpty(tbx.Text))
return;
try
{
var xamlReader = new XamlReader();
using (var stream = new MemoryStream(Encoding.Default.GetBytes(tbx.Text)))
{
var ctx = new ParserContext();
ctx.XmlnsDictionary.Add(string.Empty, @"http://schemas.microsoft.com/winfx/2006/xaml/presentation");
ctx.XmlnsDictionary.Add("x", @"http://schemas.microsoft.com/winfx/2006/xaml");
cnt.Content = xamlReader.LoadAsync(stream, ctx);
}
}
catch (Exception ex)
{
MessageBox.Show(ex.Message);
}
}
}
}After all of this I have found if paste following code into window's text box:
<Grid xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
xmlns:sys="clr-namespace:System;assembly=mscorlib"
xmlns:io="clr-namespace:System.IO;assembly=mscorlib"
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"><Grid.Resources><x:Array x:Key="directories" Type="{x:Type sys:String}"><sys:String>C:\</sys:String><sys:String>C:\Windows\</sys:String><sys:String>C:\Windows\System32\</sys:String></x:Array><ObjectDataProvider x:Key="fileList" ObjectType="{x:Type io:Directory}" MethodName="GetFiles"><ObjectDataProvider.MethodParameters><!-- Initial value, this will get wiped out by the Binding below. --><sys:String>C:\</sys:String></ObjectDataProvider.MethodParameters></ObjectDataProvider></Grid.Resources><TabControl ItemsSource="{StaticResource directories}"><TabControl.ItemContainerStyle><Style TargetType="{x:Type TabItem}"><Setter Property="ContentTemplate"><Setter.Value><DataTemplate DataType="{x:Type sys:String}"><ListBox ItemsSource="{Binding Source={StaticResource fileList}}"/></DataTemplate></Setter.Value></Setter></Style></TabControl.ItemContainerStyle><TabControl.SelectedItem><Binding Source="{StaticResource fileList}"
Path="MethodParameters[0]"
BindsDirectlyToSource="True"
Mode="OneWayToSource"/></TabControl.SelectedItem></TabControl></Grid>and press Load button, I receive following result:
Can I disable such insecure behavior?