Fix potential issues in WPF Native Code

[himgoyalmicro]

Fixes #11782
Fixes #11783
Fixes #11784

Description

Fix potential issues in WPF Native Code

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

This PR hardens WPF’s native rendering / printing code and managed XAML loading/navigation paths against malicious or malformed inputs (notably attacker-controlled XAML scenarios), aligning with the security advisories linked in #11782 / #11783 / #11784.

Changes:

• Add bounds/range checks in WpfGfx native code paths (pixel shader translation, guideline frame allocations) guarded by an AppContext switch.
• Add a new System.Printing AppContext switch and cap gradient group ranges to avoid overflow in GDI gradient fill calculations.
• Treat certain navigation/XAML load scenarios as “unsafe” and route through the restrictive XAML reader; enable restrictive loading for undo/clipboard-related XAML roundtrips.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/fxjit/PixelShader/pstrans.cpp	Adds bytecode size and token/register bounds checks to avoid overflows / OOB access during pixel shader translation.
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/fxjit/PixelShader/precomp.h	Includes WpfGfxSwitches so new bounds-check protections can be toggled.
src/Microsoft.DotNet.Wpf/src/WpfGfx/core/common/guidelinecollection.cpp	Uses overflow-checked size computations for CSnappingFrame allocation when protections are enabled.
src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/src/GDIExporter/gdirt.cpp	Caps gradient group range (with switch) to prevent overflows in band/vertex/index computations.
src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/inc/PrintingSwitches.h	Adds an AppContext-backed switch to disable printing bounds-check protection.
src/Microsoft.DotNet.Wpf/src/System.Printing/CPP/inc/GDIExporter/precomp.hpp	Includes PrintingSwitches.h for use by the GDI exporter.
src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Navigation/NavigationService.cs	Marks NavigationService as unsafe when navigation originates from FixedPage NavigateUri scenarios.
src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Markup/XamlReader.cs	Propagates “unsafe” state when using RestrictiveXamlXmlReader to ResourceDictionary / Frame / NavigationWindow.
src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/TextTreeDeleteContentUndoUnit.cs	Switches undo-object rehydration to use the restrictive XAML reader.
src/Microsoft.DotNet.Wpf/src/PresentationFramework/MS/Internal/Ink/ClipboardProcessor.cs	Switches InkCanvas copy rehydration to use the restrictive XAML reader.

Comments suppressed due to low confidence (2)

src/Microsoft.DotNet.Wpf/src/PresentationFramework/MS/Internal/Ink/ClipboardProcessor.cs:345

• XamlReader.Load(..., useRestrictiveXamlReader: true) can return null (if the restrictive reader skips the root) or throw (e.g., XamlObjectWriterException). As written, this can cause AddChild(newElement) / UpdateElementBounds to throw, breaking copy. Handle null/parse failures and return false so CopySelectedData can fall back to ISF-only copy.

                        string xml = XamlWriter.Save(elements[i]);

                        UIElement newElement = XamlReader.Load(new XmlTextReader(new StringReader(xml)), useRestrictiveXamlReader: true) as UIElement;
                        ((IAddChild)inkCanvas).AddChild(newElement);

                        // Now we tranform the element.
                        inkCanvasSelection.UpdateElementBounds(elements[i], newElement, transform);
                    }

src/Microsoft.DotNet.Wpf/src/PresentationFramework/System/Windows/Documents/TextTreeDeleteContentUndoUnit.cs:373

• With the restrictive XAML reader enabled, load failures may surface as System.Xaml.XamlObjectWriterException (not just XamlParseException). Without catching it, undo could throw instead of falling back to the placeholder Grid.

Consider catching XamlObjectWriterException the same way as XamlParseException so failures remain non-fatal.

                    try
                    {
                        embeddedObject = (DependencyObject)XamlReader.Load(new XmlTextReader(new StringReader(_xml)), useRestrictiveXamlReader: true);
                    }
                    catch (XamlParseException e)
                    {
                        Invariant.Assert(e != null); // Placed here for debugging convenience - to be able to see the exception.
                    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.