Enable and disable RDL sandboxing for Reporting Services in SharePoint integrated mode

Applies to:  SQL Server Reporting Services (2016)  SharePoint ❌ Power BI Report Server

For content related to previous versions of SQL Server Reporting Services (SSRS), see What is SQL Server Reporting Services?

The Report Definition Language (RDL) sandboxing feature lets you detect and restrict the usage of specific types of resources, by individual tenants, in an environment of multiple tenants that use a single web farm of report servers. An example is a hosting services scenario where you might maintain a single web farm of report servers that are used by multiple tenants, and different companies. As a report server administrator, you can enable this feature to help achieve the following objectives:

• Restrict external resource sizes. External resources include images, .xslt files, and map data.

• At report publish time, limit types and members that are used in expression text.

• At report processing time, limit the length of the text and the size of the return value for expressions.

When RDL Sandboxing is enabled, the following features are disabled:

• Custom code in the <Code> element of a report definition.

• RDL backward compatibility mode for SQL Server 2005 Reporting Services (SSRS) custom report items.

• Named parameters in expressions.

This article describes each element in the <RDLSandboxing> element in the RSReportServer.Config file. For more information about how to modify this file, see Modify a Reporting Services Configuration File (RSreportserver.config). A server trace log records activity related to the RDL Sandboxing feature. For more information about trace logs, see Report Server Service Trace Log.

Example configuration

The following example shows the settings and example values for the <RDLSandboxing> element in the RSReportServer.Config file.

<RDLSandboxing>  
   <MaxExpressionLength>5000</MaxExpressionLength>  
   <MaxResourceSize>5000</MaxResourceSize>  
   <MaxStringResultLength>3000</MaxStringResultLength>  
   <MaxArrayResultLength>250</MaxArrayResultLength>  
   <Types>  
      <Allow Namespace="System.Drawing" AllowNew="True">Bitmap</Allow>  
      <Allow Namespace="TypeConverters.Custom" AllowNew="True">*</Allow>  
   </Types>  
   <Members>  
      <Deny>Format</Deny>  
      <Deny>StrDup</Deny>  
   </Members>  
</RDLSandboxing>  

Configuration settings

The following table provides information about configuration settings. Settings are presented in the order in which they appear in the configuration file.

Working with expressions when RDL sandboxing is enabled

You can modify the RDL Sandboxing feature to help manage the resources that are used by an expression in the following ways:

• Restrict the number of characters that are used for an expression.

• Restrict the size of the result returned by an expression.

• Allow a specific list of types that can be used in an expression.

• Restrict the list of members by name for the list of allowed types that can be used in an expression.

• The RDL Sandboxing feature enables you to create a list of approved types and a list of denied members. The list of approved types is called an allowlist. The list of denied members is called a blocklist.

RDL expression results are verified at run time. RDL expressions are verified in the report definition when the report is published. Monitor the report server trace log for violations. For more information, see Report Server Service Trace Log.

Working with types

When you add a type to the allowlist, you're controlling the following entry points to access RDL expressions:

• Static members of a type.

• The Visual Basic ```New`` method.

• The <Classes> element in the report definition.

• Members that you added to the blocklist for a type in the allowlist.

The allowlist doesn't control the following entry points:

• Report datasets. Fields in report datasets that are returned from queries might contain any valid RDL type.

• Report parameters. User-supplied parameter values might contain any valid RDL type.

• Members of an enabled type that aren't in the blocklist. By default, all members of all types in the allowlist are enabled. When you add a member name to the blocklist, you're denying all members with that name across all types that are in the allowlist.

To enable a member of one type but deny a member with the same name for a different type, you must do the following actions:

• Add a <Deny> element for the member name.

• Create a proxy member with a different name on a class in a custom assembly for the member that you want to enable.

• Add that new class to the allowlist.

To add Visual Basic .NET Framework functions to the allowlist, add the corresponding types from the Microsoft.VisualBasic namespace to the allowlist.

To add Visual Basic .NET Framework type keywords to the allowlist, add the corresponding CLR type to the allowlist. For example, to use the Visual Basic .NET Framework keyword Integer, add the following XML fragment to the <RDLSandboxing> element:

<Allow Namespace="System">Int32</Allow>  

To add a generic or a Visual Basic .NET Framework nullable type to the allowlist, you must do the following actions:

• Create a proxy type for the generic or Visual Basic .NET Framework nullable type.

• Add the proxy type to the allowlist.

Adding a type from a custom assembly to the allowlist doesn't implicitly grant execute permission on the assembly. You must specifically modify the code access security file and provide execute permission to your assembly. For more information, see Code Access Security in Reporting Services.

Maintaining the <Deny> list of members

When you add a new type to the allowlist, use the following list to determine when you might have to update the blocklist of members:

• When you update a custom assembly with a version that introduces new types.

• When you add members to the types in the allowlist.

• When you update the .NET Framework on the report server.

• When you upgrade the report server to a later version of Reporting Services.

• When you update a report server to handle a later RDL schema, because new members might have been added to RDL types.

Working with operators and New

By default, Visual Basic .NET Framework language operators, except for New, are always allowed. The AllowNew attribute on the <Allow> element controls the New operator. Other language operators, such as the default collection accessor operator ! and Visual Basic .NET Framework cast macros such as CInt, are always allowed.

Adding operators to a blocklist, including custom operators, isn't supported. To exclude operators for a type, you must do the following actions:

• Create a proxy type that doesn't implement the operators that you want to exclude.

• Add the proxy type to the allowlist.

To create a new array in an RDL expression, create the array in a method on a class that you define, and add that class to the allowlist.

To create a new array in an RDL expression, you must do the following actions:

• Define a new class and create the array in a method on that class.

• Add the class to the allowlist.

Related content

• RsReportServer.config configuration file
• Report server service trace log
• Try asking the Reporting Services forum