diff --git a/xml/System.Windows.Markup/XamlReader.xml b/xml/System.Windows.Markup/XamlReader.xml index 6594391e736..37845f7b1a8 100644 --- a/xml/System.Windows.Markup/XamlReader.xml +++ b/xml/System.Windows.Markup/XamlReader.xml @@ -51,6 +51,12 @@ The implications of these statements for is that your application design must make trust decisions about the XAML you decide to load. If you are loading XAML that is not trusted, consider implementing your own sandboxing technique for how you load the resulting object graph. +### Restrictive XAML reader mode + The , , and overloads that include a `useRestrictiveXamlReader` parameter can restrict the instantiation of potentially dangerous types. This mode runs in the caller's process and doesn't create a low-privilege security boundary. + +> [!IMPORTANT] +> A restrictive or allow-list loading mode is a defense-in-depth hardening measure, not a security sandbox. It blocks a set of known-dangerous types, but it still allows many built-in types, some of which can have side effects such as loading external resources or initiating network requests. Don't treat a restrictive parse of untrusted markup as safe. Continue to isolate untrusted markup in a low-privilege boundary. + can also be called by partial trust code. In this case, Internet security zone is applied for code access security. If anything in the loaded XAML is invalid under Internet security zone, a XAML parse exception is thrown. Under XBAP and other cases that are partial trust at the platform level, where is part of the execution, you get the same exception behavior as with explicit partial trust calls. ## WPF XAML, XAML Readers/Writers, and XAML Language Versioning @@ -328,11 +334,13 @@ - To be added. - To be added. - To be added. - To be added. - To be added. + The stream that contains the XAML input to load. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + + is . @@ -402,11 +410,13 @@ - To be added. - To be added. - To be added. - To be added. - To be added. + An existing that contains the XAML input to load. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + + is . @@ -436,12 +446,14 @@ - To be added. - To be added. - To be added. - To be added. - To be added. - To be added. + The stream that contains the XAML input to load. + Context information used by the parser. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified by using the specified and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + + is . @@ -577,11 +589,16 @@ - To be added. - To be added. - To be added. - To be added. - This method stores in the task it returns all non-usage exceptions that the method's synchronous counterpart can throw. If an exception is stored into the returned task, that exception will be thrown when the task is awaited. Usage exceptions, such as , are still thrown synchronously. For the stored exceptions, see the exceptions thrown by . + The stream that contains the XAML input to load. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + +This method stores in the task it returns all non-usage exceptions that the method's synchronous counterpart can throw. If an exception is stored into the returned task, that exception will be thrown when the task is awaited. Usage exceptions, such as , are still thrown synchronously. For the stored exceptions, see the exceptions thrown by . + + is . + Multiple load operations are performed concurrently with the same . @@ -663,11 +680,16 @@ - To be added. - To be added. - To be added. - To be added. - This method stores in the task it returns all non-usage exceptions that the method's synchronous counterpart can throw. If an exception is stored into the returned task, that exception will be thrown when the task is awaited. Usage exceptions, such as , are still thrown synchronously. For the stored exceptions, see the exceptions thrown by . + An existing that contains the XAML input to load. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + +This method stores in the task it returns all non-usage exceptions that the method's synchronous counterpart can throw. If an exception is stored into the returned task, that exception will be thrown when the task is awaited. Usage exceptions, such as , are still thrown synchronously. For the stored exceptions, see the exceptions thrown by . + + is . + Multiple load operations are performed concurrently with the same . @@ -697,12 +719,17 @@ - To be added. - To be added. - To be added. - To be added. - To be added. - This method stores in the task it returns all non-usage exceptions that the method's synchronous counterpart can throw. If an exception is stored into the returned task, that exception will be thrown when the task is awaited. Usage exceptions, such as , are still thrown synchronously. For the stored exceptions, see the exceptions thrown by . + The stream that contains the XAML input to load. + Context information used by the parser. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified by using the specified and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + +This method stores in the task it returns all non-usage exceptions that the method's synchronous counterpart can throw. If an exception is stored into the returned task, that exception will be thrown when the task is awaited. Usage exceptions, such as , are still thrown synchronously. For the stored exceptions, see the exceptions thrown by . + + is . + Multiple load operations are performed concurrently with the same . @@ -810,11 +837,13 @@ - To be added. - To be added. - To be added. - To be added. - To be added. + The XAML input, as a single text string. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified text string and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + + is . @@ -885,12 +914,14 @@ - To be added. - To be added. - To be added. - To be added. - To be added. - To be added. + The XAML input, as a single text string. + Context information used by the parser. + to restrict the instantiation of potentially dangerous types; otherwise, . + Reads the XAML input in the specified text string by using the specified and returns the root of the corresponding object tree. + The root of the created object tree. + Restrictive mode is a defense-in-depth measure. Don't treat a restrictive parse of untrusted XAML as safe or as a replacement for isolation in a low-privilege sandbox. + + is .