XBAP deep binding. Possible security threats?
I have a WPF XBAP application that renders various pages inside a frame. I was thinking about allowing deep linking to this application. So that users can link to something like http: //myhost/myapp.xbap? Page = MyPage and then when the app loads, I automatically set MyPage.xaml as the source of my main frame.
I think I have an understanding of how to achieve this. What I don't know is, should I do any kind of disinfection of such a setting to prevent possible security vulnerabilities? Or is this not a problem in such a scenario in WPF?
source to share
I think it all depends on how you handle dynamically loading your XAML. If you just generate the XAML filename directly from the parameter, you could potentially let the user load whatever XAML they want in your application (including anything you might not want the user to have access to, if possible in your application.
You might want to consider having some kind of mapping file that maps parameters to XAML files. This way you can check to make sure the parameter is valid and the user can only access the XAML elements that you want to share.
Other than that ... good luck!
source to share