Property ImageResolver
- Namespace
- DocWright.Reporting.Pagination
- Assembly
- DocWright.Reporting.dll
ImageResolver
Gets or sets what turns an External image's reference into bytes, or null — the default —
in which case no external image is fetched and each one is reported as DXP9402.
public ReportImageResolver? ImageResolver { get; set; }Property Value
Remarks
Why this is null by default. A report definition is untrusted input that contains
references, and an engine that resolved them itself would fetch whatever a report author wrote —
an intranet address, a cloud metadata endpoint, a file path — using the credentials and the
network position of the host that rendered the report. That is server-side request forgery with
the report as the payload, and it is not a setting to be turned off; it is a capability the
library does not have. Nothing in DocWright.Reporting can open a socket or a file, and an
isolation test scans the compiled assembly to keep it that way.
A host that knows which references are safe — a fixed allow-list, an internal asset
store, a cache it populated — supplies one of these. It is handed the resolved value of the
image's Value expression and returns the encoded bytes with their content type, or null
to decline. It is called at most once per distinct reference per pagination, and may be called
from whatever thread paginates, so it must be thread-safe and must not block indefinitely.