Question

I failed a security scan.

maxOccurs=”unbounded”

Comes up in an xsd on my silverlight client for a service reference to one of my web services.

Is there an attribute or something I can set in the web service to prevent the xsd from being generated this way?

It is actually a WCF

Answer 1

There’s no support in WCF. Even if you do real contract-first and write the message contract by hand when wcf generates classes from you wsdl+xsd, it’ll ignore the maxOccurs value if it’s greater than 1. So when you expose the service, generated contract will again have maxOccurs="unbounded".

However, you can easily change this behavior by implementing a custom endpoint behavior implementing IWsdlExportExtension, IEndpointBehavior interfaces:

• Create you classes from contract (wsdl+xsd)
• Copy your contract files in a folder on your service host project
• Add your endpoint behavior to your service endpoint
• In the endpoint behavior class replace the generated schema imports with your real xsd’s

In this way generated contracts will include your original schema’s instead of generated ones.

Additionally you’ll need to validate the XML file with your xsd’s. Because WCF will not validate your maxOccurs attributes.