.Net: Bound element nesting depth in XML prompt parsing - #14504

Motivation and Context

XmlPromptParser converts chat prompts such as <message role="user">...</message> into PromptNode trees that ChatPromptParser turns into a ChatHistory. Each PromptNode stores the serialized inner XML of its element, so the parser re-serializes and decodes the whole remaining subtree at every nesting level. Parse work therefore grows with nesting depth multiplied by prompt size, and the recursive node builder had no depth bound.

Supported chat prompt structure is shallow: message elements with optional text, image, audio, and binary children, plus encoded or CDATA text. This change bounds element nesting so parsing cost stays proportional to prompt size.

Description

• Add XmlPromptParser.MaxElementDepth (internal, 64, top-level prompt elements count as depth 1, matching the System.Text.Json default maximum depth).
• After the prompt is loaded and before any PromptNode is built, a single non-recursive walk checks element depth. Prompts nested deeper than the limit return false from TryParse.
• A rejected prompt takes the existing invalid-XML path: callers such as GetChatMessageContentsAsync(string) send the whole prompt as one user text message, exactly as they already do for malformed XML.
• Parse work for accepted prompts is bounded by the depth limit times prompt size, and recursion in GetPromptNode is bounded.
• No public API change. Prompts within the limit, including content items, CDATA, and encoded content, parse exactly as before.

Tests:

• XmlPromptParserTests: parses two prompts at exactly the maximum depth; rejects one level over and far over the limit; rejects when only a later top-level node exceeds the limit (covers sibling traversal after a max-depth subtree).
• ChatPromptParserTests: a user message whose content exceeds the limit makes ChatPromptParser.TryParse return false.

Validation

All local runs use -c Debug on .NET SDK 10.0.401.

• Build with --warnaserror: SemanticKernel.Abstractions (net10.0, net8.0, netstandard2.0), SemanticKernel.UnitTests, Extensions.UnitTests, PromptTemplates.Liquid.UnitTests, Agents.UnitTests, IntegrationTests: 0 warnings, 0 errors.
• dotnet format --verify-no-changes in mcr.microsoft.com/dotnet/sdk:10.0 for both changed projects: clean.
• SemanticKernel.UnitTests: 1614/1614 pass, including the 5 new tests. The new over-limit tests fail without the parser change.
• Extensions.UnitTests (Handlebars) 90/90, PromptTemplates.Liquid.UnitTests 16/16, Agents.UnitTests 504/504 executed tests pass, IntegrationTests CrossLanguage (offline, stubbed HTTP request shape) 37/37.
• Normal chat prompts produce the same ChatHistory on net10.0, net8.0, and .NET Framework 4.8 (netstandard2.0 asset), and the largest prompts still accepted parse in time proportional to their size.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄