npx skills add ...
npx skills add syncfusion/wpf-ui-components-skills --skill syncfusion-wpf-markdown-viewer
Implement Syncfusion WPF SfMarkdownViewer for rendering and displaying Markdown content in WPF applications. Use this when rendering Markdown text, loading Markdown from strings or application-controlled local files, handling hyperlink clicks with URL validation, or displaying Mermaid diagrams with input sanitization. Covers the Source property, HyperlinkClicked events with allowlist-based navigation, and MermaidBlockTemplate customization with input validation. Always validate and sanitize Markdown content before assigning to Source, especially when the content originates from remote or user-supplied sources.
npx skills add syncfusion/wpf-ui-components-skills --skill syncfusion-wpf-markdown-viewer
The SfMarkdownViewer renders Markdown content — headings, lists, links, images, tables, code blocks, and block quotes — into a styled WPF visual. Use it to display documentation, release notes, help content, README files, or any Markdown-based content without external rendering engines.
⚠️ Out of scope: Do not use this skill to load Markdown directly from arbitrary third-party URLs or unvalidated user input without fetching, validating, and sanitizing the content in application code first.
📄 Read: references/getting-started.md
📄 Read: references/loading-content.md
📄 Read: references/events.md
app:// links📄 Read: references/mermaid-diagrams.md
| Property | Type | Purpose |
|---|---|---|
Source | string | Raw Markdown string, file path, or HTTP/HTTPS URL |
MermaidBlockTemplate | DataTemplate | Custom template for rendering mermaid code blocks |
| Event | Args | Purpose |
|---|---|---|
HyperlinkClicked | MarkdownHyperlinkClickedEventArgs | Fires when user clicks a hyperlink in rendered Markdown |
Source directly.md file bundled with the application (not a path from user input) and assign its text to SourceSource — never pass a third-party URL directly to SourceMermaidBlockTemplate with SfDiagram to render flowcharts; validate the Mermaid DataContext string (length and type prefix) before calling LoadDiagramFromMermaid()HyperlinkClicked with cancel-by-default; validate app:// routes against an explicit allowlist and only permit https:// external links| Risk | Mitigation |
|---|---|
| Remote URL loads untrusted third-party Markdown | Fetch content in app code; validate origin (allowlisted base URL) and content-type before assigning to Source |
| Hyperlink in Markdown drives unintended navigation | Use cancel-by-default in HyperlinkClicked; validate app:// routes against a fixed allowlist; only permit https:// external links |
| Mermaid block from untrusted Markdown drives diagram rendering | Validate DataContext string: check non-null, enforce length limit, allowlist diagram type prefixes before calling LoadDiagramFromMermaid() |
User-supplied URL passed to Source | Never accept URLs from user input or third-party data as-is; always validate origin in application code first |
using Syncfusion.UI.Xaml.Markdown;
SfMarkdownViewer markdownViewer = new SfMarkdownViewer();
markdownViewer.Source = "# Hello World\n\nThis is **bold** and *italic* text.";
this.Content = markdownViewer;