Quantcast
Channel: Windows Presentation Foundation (WPF) forum
Viewing all articles
Browse latest Browse all 18858

Security of loading XAML Content received from server and loaded to ContentControl via XamlReader.LoadAsync

$
0
0

Imagine that...

I have WPF application and many users use it.
I want to show my application users information about upcoming events.

Can I disable following insecure behavior?

I wrote following code:

My WPF Window:

<Window x:Class="MyApplication.MainWindow"
		xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
		xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
		Title="MainWindow"
		Height="350"
		Width="525"><Grid><Grid.RowDefinitions><RowDefinition Height="Auto" /><RowDefinition Height="*" /><RowDefinition Height="*" /></Grid.RowDefinitions><Button x:Name="btnLoad"
				Content="_Load"
				Click="btnLoad_Click" /><TextBox x:Name="tbx"
				 AcceptsReturn="True"
				 Grid.Row="1"
				 AcceptsTab="True" /><ContentControl x:Name="cnt"
						Grid.Row="2" /></Grid></Window>

And that WPF Window Code Behind:

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Windows;
using System.Windows.Markup;

namespace MyApplication
{
	public partial class MainWindow : Window
	{
		public MainWindow()
		{
			InitializeComponent();
		}

		private void btnLoad_Click(object sender, RoutedEventArgs e)
		{
			cnt.Content = string.Empty;

			if (string.IsNullOrEmpty(tbx.Text))
				return;

			try
			{
				var xamlReader = new XamlReader();
				using (var stream = new MemoryStream(Encoding.Default.GetBytes(tbx.Text)))
				{
					var ctx = new ParserContext();
					ctx.XmlnsDictionary.Add(string.Empty, @"http://schemas.microsoft.com/winfx/2006/xaml/presentation");
					ctx.XmlnsDictionary.Add("x", @"http://schemas.microsoft.com/winfx/2006/xaml");
					cnt.Content = xamlReader.LoadAsync(stream, ctx);
				}
			}
			catch (Exception ex)
			{
				MessageBox.Show(ex.Message);
			}
		}
	}
}

After all of this I have found if paste following code into window's text box:

<Grid xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
  xmlns:sys="clr-namespace:System;assembly=mscorlib"
  xmlns:io="clr-namespace:System.IO;assembly=mscorlib"
  xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"><Grid.Resources><x:Array x:Key="directories" Type="{x:Type sys:String}"><sys:String>C:\</sys:String><sys:String>C:\Windows\</sys:String><sys:String>C:\Windows\System32\</sys:String></x:Array><ObjectDataProvider x:Key="fileList" ObjectType="{x:Type io:Directory}" MethodName="GetFiles"><ObjectDataProvider.MethodParameters><!-- Initial value, this will get wiped out by the Binding below. --><sys:String>C:\</sys:String></ObjectDataProvider.MethodParameters></ObjectDataProvider></Grid.Resources><TabControl ItemsSource="{StaticResource directories}"><TabControl.ItemContainerStyle><Style TargetType="{x:Type TabItem}"><Setter Property="ContentTemplate"><Setter.Value><DataTemplate DataType="{x:Type sys:String}"><ListBox ItemsSource="{Binding Source={StaticResource fileList}}"/></DataTemplate></Setter.Value></Setter></Style></TabControl.ItemContainerStyle><TabControl.SelectedItem><Binding Source="{StaticResource fileList}"    
					 Path="MethodParameters[0]"
					 BindsDirectlyToSource="True"  
					 Mode="OneWayToSource"/></TabControl.SelectedItem></TabControl></Grid>

and press Load button, I receive following result:

XAML content loaded from string via XamlReader.LoadAsync

Can I disable such insecure behavior?


Viewing all articles
Browse latest Browse all 18858

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>