Imagine that...
I have WPF application and many users use it.
I want to show my application users information about upcoming events.
Can I disable following insecure behavior?
I wrote following code:
My WPF Window:
<Window x:Class="MyApplication.MainWindow" xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" Title="MainWindow" Height="350" Width="525"><Grid><Grid.RowDefinitions><RowDefinition Height="Auto" /><RowDefinition Height="*" /><RowDefinition Height="*" /></Grid.RowDefinitions><Button x:Name="btnLoad" Content="_Load" Click="btnLoad_Click" /><TextBox x:Name="tbx" AcceptsReturn="True" Grid.Row="1" AcceptsTab="True" /><ContentControl x:Name="cnt" Grid.Row="2" /></Grid></Window>
And that WPF Window Code Behind:
using System; using System.Collections.Generic; using System.IO; using System.Linq; using System.Text; using System.Windows; using System.Windows.Markup; namespace MyApplication { public partial class MainWindow : Window { public MainWindow() { InitializeComponent(); } private void btnLoad_Click(object sender, RoutedEventArgs e) { cnt.Content = string.Empty; if (string.IsNullOrEmpty(tbx.Text)) return; try { var xamlReader = new XamlReader(); using (var stream = new MemoryStream(Encoding.Default.GetBytes(tbx.Text))) { var ctx = new ParserContext(); ctx.XmlnsDictionary.Add(string.Empty, @"http://schemas.microsoft.com/winfx/2006/xaml/presentation"); ctx.XmlnsDictionary.Add("x", @"http://schemas.microsoft.com/winfx/2006/xaml"); cnt.Content = xamlReader.LoadAsync(stream, ctx); } } catch (Exception ex) { MessageBox.Show(ex.Message); } } } }
After all of this I have found if paste following code into window's text box:
<Grid xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:sys="clr-namespace:System;assembly=mscorlib" xmlns:io="clr-namespace:System.IO;assembly=mscorlib" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"><Grid.Resources><x:Array x:Key="directories" Type="{x:Type sys:String}"><sys:String>C:\</sys:String><sys:String>C:\Windows\</sys:String><sys:String>C:\Windows\System32\</sys:String></x:Array><ObjectDataProvider x:Key="fileList" ObjectType="{x:Type io:Directory}" MethodName="GetFiles"><ObjectDataProvider.MethodParameters><!-- Initial value, this will get wiped out by the Binding below. --><sys:String>C:\</sys:String></ObjectDataProvider.MethodParameters></ObjectDataProvider></Grid.Resources><TabControl ItemsSource="{StaticResource directories}"><TabControl.ItemContainerStyle><Style TargetType="{x:Type TabItem}"><Setter Property="ContentTemplate"><Setter.Value><DataTemplate DataType="{x:Type sys:String}"><ListBox ItemsSource="{Binding Source={StaticResource fileList}}"/></DataTemplate></Setter.Value></Setter></Style></TabControl.ItemContainerStyle><TabControl.SelectedItem><Binding Source="{StaticResource fileList}" Path="MethodParameters[0]" BindsDirectlyToSource="True" Mode="OneWayToSource"/></TabControl.SelectedItem></TabControl></Grid>
and press Load button, I receive following result:
Can I disable such insecure behavior?