Skip to content

Commit cf2eb91

Browse files
Fix XML injection in toast sample; update broken share-target link
- Add SecurityElement.Escape() to C# toast XML sample - Add XmlEscape() helper to C++/WinRT toast XML sample - Replace deleted desktop-to-uwp-extend.md link in get-activation-info with modern integrate-sharesheet-packaged.md Addresses Copilot PR review feedback on PR #6596. Co-authored-by: Copilot <[email protected]>
1 parent bb98fe8 commit cf2eb91

2 files changed

Lines changed: 25 additions & 7 deletions

File tree

hub/apps/desktop/modernize/desktop-to-uwp-enhance.md

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -127,16 +127,17 @@ Once your project is configured, you can call WinRT APIs directly. The following
127127
128128

129129
```csharp
130+
using System.Security;
130131
using Windows.Data.Xml.Dom;
131132
using Windows.UI.Notifications;
132133

133134
void ShowToast(string title, string content, string image, string logo)
134135
{
135136
string xmlString =
136137
$@"<toast><visual><binding template='ToastGeneric'>" +
137-
$"<text>{title}</text><text>{content}</text>" +
138-
$"<image src='{image}'/>" +
139-
$"<image src='{logo}' placement='appLogoOverride' hint-crop='circle'/>" +
138+
$"<text>{SecurityElement.Escape(title)}</text><text>{SecurityElement.Escape(content)}</text>" +
139+
$"<image src='{SecurityElement.Escape(image)}'/>" +
140+
$"<image src='{SecurityElement.Escape(logo)}' placement='appLogoOverride' hint-crop='circle'/>" +
140141
"</binding></visual></toast>";
141142

142143
XmlDocument toastXml = new XmlDocument();
@@ -153,13 +154,30 @@ void ShowToast(string title, string content, string image, string logo)
153154
using namespace winrt::Windows::UI::Notifications;
154155
using namespace winrt::Windows::Data::Xml::Dom;
155156
157+
std::wstring XmlEscape(std::wstring_view input)
158+
{
159+
std::wstring result;
160+
result.reserve(input.size());
161+
for (wchar_t ch : input) {
162+
switch (ch) {
163+
case L'&': result += L"&amp;"; break;
164+
case L'<': result += L"&lt;"; break;
165+
case L'>': result += L"&gt;"; break;
166+
case L'\'': result += L"&apos;"; break;
167+
case L'"': result += L"&quot;"; break;
168+
default: result += ch; break;
169+
}
170+
}
171+
return result;
172+
}
173+
156174
void ShowToast(std::wstring title, std::wstring content, std::wstring image, std::wstring logo)
157175
{
158176
std::wostringstream xml;
159177
xml << L"<toast><visual><binding template='ToastGeneric'>"
160-
<< L"<text>" << title << L"</text><text>" << content << L"</text>"
161-
<< L"<image src='" << image << L"'/>"
162-
<< L"<image src='" << logo << L"' placement='appLogoOverride' hint-crop='circle'/>"
178+
<< L"<text>" << XmlEscape(title) << L"</text><text>" << XmlEscape(content) << L"</text>"
179+
<< L"<image src='" << XmlEscape(image) << L"'/>"
180+
<< L"<image src='" << XmlEscape(logo) << L"' placement='appLogoOverride' hint-crop='circle'/>"
163181
<< L"</binding></visual></toast>";
164182
165183
XmlDocument toastXml;

hub/apps/desktop/modernize/get-activation-info-for-packaged-apps.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ You can use the [AppInstance.GetActivatedEventArgs](/uwp/api/windows.application
5959

6060
| Event args type | Package extension | Related docs |
6161
|-------------------|-----------------|-----------------------|
62-
| [ShareTargetActivatedEventArgs](/uwp/api/windows.applicationmodel.activation.sharetargetactivatedeventargs) | [uap:ShareTarget](/uwp/schemas/appxpackage/uapmanifestschema/element-uap-sharetarget) | [Making your desktop application a share target](./desktop-to-uwp-extend.md#making-your-desktop-application-a-share-target) |
62+
| [ShareTargetActivatedEventArgs](/uwp/api/windows.applicationmodel.activation.sharetargetactivatedeventargs) | [uap:ShareTarget](/uwp/schemas/appxpackage/uapmanifestschema/element-uap-sharetarget) | [Integrate packaged apps with Windows Share](../../develop/windows-integration/integrate-sharesheet-packaged.md) |
6363
| [ProtocolActivatedEventArgs](/uwp/api/windows.applicationmodel.activation.protocolactivatedeventargs) | [uap:Protocol](/uwp/schemas/appxpackage/uapmanifestschema/element-uap-protocol) | [Start your application by using a protocol](./desktop-to-uwp-extensions.md#start-your-application-by-using-a-protocol) |
6464
| [ToastNotificationActivatedEventArgs](/uwp/api/windows.applicationmodel.activation.toastnotificationactivatedeventargs) | desktop:ToastNotificationActivation | [Toast notifications from desktop apps](/windows/uwp/design/shell/tiles-and-notifications/toast-desktop-apps). |
6565
| [StartupTaskActivatedEventArgs](/uwp/api/windows.applicationmodel.activation.startuptaskactivatedeventargs) | desktop:StartupTask | [Start an executable file when users log into Windows](./desktop-to-uwp-extensions.md#start-an-executable-file-when-users-log-into-windows) |

0 commit comments

Comments
 (0)