Safe URL Validation

• Feb 25, 2026
• 5 minutes to read

DevExpress Reports automatically validates and sanitizes all external URLs used within a report document. URL validation helps protect your application against cross-site scripting (XSS), server-side request forgery (SSRF), phishing, and similar URL-based attacks.

Automatic URL Validation

The DevExpress URL validation engine analyzes all URLs before they are processed, displayed, or executed. It applies multi-layered protection against malicious or malformed input by validating each URL and blocking unsafe schemes, malformed data, deceptive characters, and private network targets.

Validation behavior depends on the application platform.

Desktop Applications (WinForms and WPF)

In desktop reporting applications, hyperlinks and other actions that initiate process execution are validated according to DevExpress Safe URL Validation policy.

Validation is performed as follows:

• URLs that comply with URL Validation Security rules are allowed.
• URLs or process requests that do not comply with the policy require explicit user confirmation.
• A confirmation dialog is displayed before the URL is opened or the process is started, unless the resource is explicitly registered as trusted or allowed in the ConfirmationRequest event handler.

Web Applications

In web reporting applications, hyperlinks, images, and data connections that reference external URLs are validated as follows:

• Safe URLs (for example, https://example.com) are rendered as active links.
• Invalid or unsafe URLs are displayed as plain text.
• Unsafe URLs are blocked silently without raising exceptions.

Note

Invalid or blocked URLs are rendered as inert plain text. They are not fetched, dereferenced, or executed.

URL Validation Security Rules

The following table summarizes security checks executed during URL validation and describes how each mitigates potential threats:

Custom URL Validation

Handle the AccessSettings.UriValidated event to override built-in validation and/or implement additional application-specific URL policies.

The following code snippet allows URLs hosted on a specific trusted domain:

AccessSettings.UriValidated += (s, e) => {
    var uri = e.Uri;
    if (uri == null)
        return;

    // Restrict to HTTPS only.
    if (uri.Scheme != Uri.UriSchemeHttps)
        return;

    // Allow exact domain or its subdomains.
    var host = uri.Host;
    if (host.Equals("trustedsource.com", StringComparison.OrdinalIgnoreCase) ||
        host.EndsWith(".trustedsource.com", StringComparison.OrdinalIgnoreCase)) {
        e.Valid = true;
    }
};

To restrict custom validation logic to Reporting controls, check whether ValidationContext is a ReportUriValidationContext:

AccessSettings.UriValidated += (s, e) => {
    if (e.ValidationContext is ReportUriValidationContext) {
        // ...
    }
}

Example: Startup Configuration

void Application_Start(object sender, EventArgs e) {
    // Restrict data source access.
    AccessSettings.DataResources.SetRules(
        DirectoryAccessRule.Allow(Server.MapPath("~/App_Data/")),
        UrlAccessRule.Allow("https://trustedsource.com/")
    );

    // Apply custom validation rules (exact domain or subdomains only).
    // Log rejected and explicitly approved URLs.
    AccessSettings.UriValidated += (s, e) => {
        var uri = e.Uri;
        if (uri == null)
            return;

        bool initiallyValid = e.Valid;

        var host = uri.Host;
        if (host.Equals("trustedsource.com", StringComparison.OrdinalIgnoreCase) ||
            host.EndsWith(".trustedsource.com", StringComparison.OrdinalIgnoreCase)) {
            e.Valid = true;
        }

        if (!initiallyValid && e.Valid) {
            Log.Info($"URL override accepted: {uri}");
        } else if (initiallyValid && !e.Valid) {
            Log.Warn($"URL override blocked: {uri}");
        } else if (!e.Valid) {
            Log.Info($"URL rejected (built-in): {uri}");
        }
    };
}

Warning

Ensure that logs do not contain sensitive information/tokens embedded in query strings.

Security Best Practices

Even with built-in protection, we recommend that you reinforce security through configuration and controlled access:

• Restrict data source access with AccessSettings.DataResources.

• Limit reports to approved folders or trusted web domains.

• Disallow unsafe or unnecessary URI schemes (enable additional schemes only when absolutely required).

• Handle the AccessSettings.UriValidated event to implement organization-specific logic such as:

  • Whitelisting : Restrict URLs to corporate or otherwise trusted domains.
  • Audit logging : Record timestamp, original URL, and validation decisions.

• Monitor audit logs for rejected or suspicious URLs to detect attempted attacks or configuration issues.

See Also

Reporting — Safe Deserialization

DevExpress Reporting - Security Considerations