Review code for XAML injection vulnerabilities
Review code for XAML injection vulnerabilities
Microsoft docsDescription
When working with untrusted input, be mindful of XAML injection attacks. XAML is a markup language that directly represents object instantiation and execution. That means elements created in XAML can interact with system resources (for example, network access and file system IO). If an attacker can control the input to a System.Windows.Markup.XamlReader Load method call, then the attacker can execute code.
This rule attempts to find input from HTTP requests that reaches a System.Windows.Markup.XamlReader Load method. This rule can't track data across assemblies. For example, if one assembly reads the HTTP request input and then passes it to another assembly that loads XAML, this rule won't produce a warning. There is a configurable limit to how deep this rule will analyze data flow across method calls. See Analyzer Configuration for how to configure the limit in an EditorConfig file.
Cause
Potentially untrusted HTTP request input reaches a System.Windows.Markup.XamlReader Load method.
By default, this rule analyzes the entire codebase, but this is configurable.
How to fix violations
Don't load untrusted XAML.
Example
using System;
using System.IO;
public partial class WebForm : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
string input = Request.Form["in"];
byte[] bytes = Convert.FromBase64String(input);
MemoryStream ms = new MemoryStream(bytes);
System.Windows.Markup.XamlReader.Load(ms);
}
}When to suppress
Don't suppress warnings from this rule.