Clarify guidance on loading untrusted XAML, BAML, and XPS content

[vinnarayana-msft]

Summary

Clarifies security guidance for loading untrusted markup (XAML, BAML, and XPS/fixed documents) across the desktop docs. The core message: loading markup from a source you don't control is equivalent to running untrusted code, and restrictive/allow-list loading is a defense-in-depth hardening measure — not a security sandbox.

Changes

• xaml-services/security-considerations.md (platform-agnostic .NET XAML Services)
  • Added an Important note that there's no supported way to safely load fully untrusted XAML in-process, and that the application — not the parser — owns the trust decision.
  • Added generic guidance on compiled/binary forms of XAML and on restrictive readers as hardening rather than a sandbox.
  • Added a cross-link to the WPF-specific security article.
• wpf/security-wpf.md (WPF-specific)
  • Added a new section, Loading Untrusted XAML, BAML, and XPS Content, covering text XAML, binary XAML (BAML), and XPS/fixed-document containers.
  • Added an Important note that a restrictive/allow-list load isn't a security sandbox.
  • Updated the contents list and See also, with a cross-link back to the XAML Services article.

Why

The existing articles stated the general "treat untrusted XAML like untrusted code" principle but didn't explicitly cover binary XAML (BAML) or document-container inputs, and didn't clarify that restrictive loading is a hardening step rather than a safe boundary. This adds that guidance so developers make correct trust decisions.

Notes

• Guidance is intentionally generic; it names the relevant public loading APIs but doesn't describe specific exploit techniques.
• All API references use validated cross-references (<xref:...>) to public APIs.
• Documentation-only change — no code or samples added.

---

Internal previews

📄 File	🔗 Preview link
dotnet-desktop-guide/wpf/security-wpf.md	dotnet-desktop-guide/wpf/security-wpf
dotnet-desktop-guide/xaml-services/security-considerations.md	dotnet-desktop-guide/xaml-services/security-considerations

[Copilot]

Pull request overview

This PR clarifies security guidance across the desktop documentation to emphasize that loading markup (XAML, compiled/binary forms like BAML, and XPS/fixed-document content) from untrusted sources is equivalent to running untrusted code, and that restrictive or allow-list loading is defense-in-depth hardening—not a security sandbox.

Changes:

• Adds an IMPORTANT note and new subsections to the XAML Services security article covering fully untrusted markup, binary XAML, and restrictive readers.
• Adds a new WPF section on loading untrusted XAML, BAML, and XPS content, and updates the contents list and See also links to cross-reference the XAML Services article.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
dotnet-desktop-guide/xaml-services/security-considerations.md	Adds platform-agnostic guidance and cross-links about untrusted XAML, including binary forms and restrictive-reader limitations.
dotnet-desktop-guide/wpf/security-wpf.md	Adds WPF-specific guidance for untrusted XAML/BAML/XPS loading, and cross-links back to the general XAML Services security guidance.