Implementing WPF SfMarkdownViewer
The SfMarkdownViewer renders Markdown content — headings, lists, links, images, tables, code blocks, and block quotes — into a styled WPF visual. Use it to display documentation, release notes, help content, README files, or any Markdown-based content without external rendering engines.
When to Use This Skill
- User needs to render or preview Markdown content in a WPF app
- Loading Markdown from a hard-coded string, application-bundled resource, or application-controlled local file
- Displaying documentation, changelogs, or help text that originates from trusted, application-owned sources
- Intercepting hyperlink navigation with URL validation and allowlisting
- Rendering Mermaid flowchart diagrams with input length and type validation
⚠️ Out of scope: Do not use this skill to load Markdown directly from arbitrary third-party URLs or unvalidated user input without fetching, validating, and sanitizing the content in application code first.
Quick Start
<Window
x:Class="GettingStarted.MainWindow"
xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
xmlns:markdown="clr-namespace:Syncfusion.UI.Xaml.Markdown;assembly=Syncfusion.SfMarkdownViewer.WPF"
xmlns:system="clr-namespace:System;assembly=mscorlib">
<Grid>
<markdown:SfMarkdownViewer Source="# Hello World This is **bold** and *italic* text." />
</Grid>
</Window>
using Syncfusion.UI.Xaml.Markdown;
SfMarkdownViewer markdownViewer = new SfMarkdownViewer();
markdownViewer.Source = "# Hello World\n\nThis is **bold** and *italic* text.";
this.Content = markdownViewer;
Documentation and Navigation Guide
Getting Started
📄 Read: references/getting-started.md
- NuGet package installation (Syncfusion.SfMarkdownViewer.Wpf)
- Required assembly references (3 assemblies)
- XAML namespace import
- Adding control via XAML and C#
- Inline Markdown string via Source property
- SfSkinManager theme support
Loading Content
📄 Read: references/loading-content.md
- Loading from raw Markdown string
- Loading from a local application-controlled file path
- Loading from a remote URL via application code (fetch → validate origin → check content-type → assign string)
- XAML CDATA string source pattern
- Decision guide: which source type to use
- Security requirements for remote content loading
Events
📄 Read: references/events.md
- HyperlinkClicked event
- MarkdownHyperlinkClickedEventArgs (Url, Cancel)
- Cancel-by-default pattern — always cancel first, then selectively permit validated URLs
- Allowlist-based in-app route validation for
app:// links
- Blocking non-HTTPS external schemes
Mermaid Diagrams
📄 Read: references/mermaid-diagrams.md
- MermaidBlockTemplate property
- Embedding SfDiagram in a DataTemplate
- Validating DataContext (Mermaid string) before rendering — length limit and type allowlist
- FlowchartLayout configuration
- LoadDiagramFromMermaid() usage
- Required dependencies for Mermaid support
Key Properties
| Property |
Type |
Purpose |
Source |
string |
Raw Markdown string, file path, or HTTP/HTTPS URL |
MermaidBlockTemplate |
DataTemplate |
Custom template for rendering mermaid code blocks |
Key Events
| Event |
Args |
Purpose |
HyperlinkClicked |
MarkdownHyperlinkClickedEventArgs |
Fires when user clicks a hyperlink in rendered Markdown |
Common Use Cases
- In-app documentation: Embed Markdown as a hard-coded string or application-bundled resource file; assign to
Source directly
- Release notes panel: Load a local
.md file bundled with the application (not a path from user input) and assign its text to Source
- Remote documentation: Fetch Markdown from an application-owned HTTPS endpoint in application code, validate the HTTP response origin and content-type, then assign the sanitized string to
Source — never pass a third-party URL directly to Source
- Help viewer: Render contextual Markdown help strings from trusted, application-controlled sources
- Diagram viewer: Use
MermaidBlockTemplate with SfDiagram to render flowcharts; validate the Mermaid DataContext string (length and type prefix) before calling LoadDiagramFromMermaid()
- Controlled navigation: Handle
HyperlinkClicked with cancel-by-default; validate app:// routes against an explicit allowlist and only permit https:// external links
Security Considerations
| Risk |
Mitigation |
| Remote URL loads untrusted third-party Markdown |
Fetch content in app code; validate origin (allowlisted base URL) and content-type before assigning to Source |
| Hyperlink in Markdown drives unintended navigation |
Use cancel-by-default in HyperlinkClicked; validate app:// routes against a fixed allowlist; only permit https:// external links |
| Mermaid block from untrusted Markdown drives diagram rendering |
Validate DataContext string: check non-null, enforce length limit, allowlist diagram type prefixes before calling LoadDiagramFromMermaid() |
User-supplied URL passed to Source |
Never accept URLs from user input or third-party data as-is; always validate origin in application code first |
1---2name: syncfusion-wpf-markdown-viewer3description: Implement Syncfusion WPF SfMarkdownViewer for rendering and displaying Markdown content in WPF applications. Use this when rendering Markdown text, loading Markdown from strings or application-controlled local files, handling hyperlink clicks with URL validation, or displaying Mermaid diagrams with input sanitization. Covers the Source property, HyperlinkClicked events with allowlist-based navigation, and MermaidBlockTemplate customization with input validation. Always validate and sanitize Markdown content before assigning to Source, especially when the content originates from remote or user-supplied sources.4---56# Implementing WPF SfMarkdownViewer78The `SfMarkdownViewer` renders Markdown content — headings, lists, links, images, tables, code blocks, and block quotes — into a styled WPF visual. Use it to display documentation, release notes, help content, README files, or any Markdown-based content without external rendering engines.910## When to Use This Skill1112- User needs to render or preview Markdown content in a WPF app13- Loading Markdown from a hard-coded string, application-bundled resource, or application-controlled local file14- Displaying documentation, changelogs, or help text that originates from trusted, application-owned sources15- Intercepting hyperlink navigation with URL validation and allowlisting16- Rendering Mermaid flowchart diagrams with input length and type validation1718> ⚠️ **Out of scope:** Do not use this skill to load Markdown directly from arbitrary third-party URLs or unvalidated user input without fetching, validating, and sanitizing the content in application code first.1920## Quick Start2122```xaml23<Window24 x:Class="GettingStarted.MainWindow"25 xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"26 xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"27 xmlns:markdown="clr-namespace:Syncfusion.UI.Xaml.Markdown;assembly=Syncfusion.SfMarkdownViewer.WPF"28 xmlns:system="clr-namespace:System;assembly=mscorlib">29 <Grid>30 <markdown:SfMarkdownViewer Source="# Hello World This is **bold** and *italic* text." />31 </Grid>32</Window>33```3435```csharp36using Syncfusion.UI.Xaml.Markdown;3738SfMarkdownViewer markdownViewer = new SfMarkdownViewer();39markdownViewer.Source = "# Hello World\n\nThis is **bold** and *italic* text.";40this.Content = markdownViewer;41```4243## Documentation and Navigation Guide4445### Getting Started46📄 **Read:** [references/getting-started.md](references/getting-started.md)47- NuGet package installation (Syncfusion.SfMarkdownViewer.Wpf)48- Required assembly references (3 assemblies)49- XAML namespace import50- Adding control via XAML and C#51- Inline Markdown string via Source property52- SfSkinManager theme support5354### Loading Content55📄 **Read:** [references/loading-content.md](references/loading-content.md)56- Loading from raw Markdown string57- Loading from a local application-controlled file path58- Loading from a remote URL via application code (fetch → validate origin → check content-type → assign string)59- XAML CDATA string source pattern60- Decision guide: which source type to use61- Security requirements for remote content loading6263### Events64📄 **Read:** [references/events.md](references/events.md)65- HyperlinkClicked event66- MarkdownHyperlinkClickedEventArgs (Url, Cancel)67- Cancel-by-default pattern — always cancel first, then selectively permit validated URLs68- Allowlist-based in-app route validation for `app://` links69- Blocking non-HTTPS external schemes7071### Mermaid Diagrams72📄 **Read:** [references/mermaid-diagrams.md](references/mermaid-diagrams.md)73- MermaidBlockTemplate property74- Embedding SfDiagram in a DataTemplate75- Validating DataContext (Mermaid string) before rendering — length limit and type allowlist76- FlowchartLayout configuration77- LoadDiagramFromMermaid() usage78- Required dependencies for Mermaid support7980## Key Properties8182| Property | Type | Purpose |83|---|---|---|84| `Source` | `string` | Raw Markdown string, file path, or HTTP/HTTPS URL |85| `MermaidBlockTemplate` | `DataTemplate` | Custom template for rendering mermaid code blocks |8687## Key Events8889| Event | Args | Purpose |90|---|---|---|91| `HyperlinkClicked` | `MarkdownHyperlinkClickedEventArgs` | Fires when user clicks a hyperlink in rendered Markdown |9293## Common Use Cases9495- **In-app documentation:** Embed Markdown as a hard-coded string or application-bundled resource file; assign to `Source` directly96- **Release notes panel:** Load a local `.md` file bundled with the application (not a path from user input) and assign its text to `Source`97- **Remote documentation:** Fetch Markdown from an application-owned HTTPS endpoint in application code, validate the HTTP response origin and content-type, then assign the sanitized string to `Source` — never pass a third-party URL directly to `Source`98- **Help viewer:** Render contextual Markdown help strings from trusted, application-controlled sources99- **Diagram viewer:** Use `MermaidBlockTemplate` with `SfDiagram` to render flowcharts; validate the Mermaid `DataContext` string (length and type prefix) before calling `LoadDiagramFromMermaid()`100- **Controlled navigation:** Handle `HyperlinkClicked` with cancel-by-default; validate `app://` routes against an explicit allowlist and only permit `https://` external links101102## Security Considerations103104| Risk | Mitigation |105|---|---|106| Remote URL loads untrusted third-party Markdown | Fetch content in app code; validate origin (allowlisted base URL) and content-type before assigning to `Source` |107| Hyperlink in Markdown drives unintended navigation | Use cancel-by-default in `HyperlinkClicked`; validate `app://` routes against a fixed allowlist; only permit `https://` external links |108| Mermaid block from untrusted Markdown drives diagram rendering | Validate `DataContext` string: check non-null, enforce length limit, allowlist diagram type prefixes before calling `LoadDiagramFromMermaid()` |109| User-supplied URL passed to `Source` | Never accept URLs from user input or third-party data as-is; always validate origin in application code first |