{"record":{"id":"32b0bd1ed777b299","repo":"dotnet/wpf","slug":"sr-unsupportedtransformalgorithm-xmlsignaturemanifest","errorCode":null,"errorMessage":"SR.UnsupportedTransformAlgorithm","messagePattern":"SR\\.UnsupportedTransformAlgorithm","errorType":"exception","errorClass":"System.InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs","lineNumber":379,"sourceCode":"                        }\n                        else\n                            throw new XmlException(SR.MultipleRelationshipTransformsFound);\n                    }                    \n                    else\n                    {\n                        // non-Relationship transform should have no children\n                        if (reader.IsEmptyElement)\n                        {\n                            if (transforms == null)\n                                transforms = new List<String>();\n\n                            if (XmlDigitalSignatureProcessor.IsValidXmlCanonicalizationTransform(transformName))\n                            {\n                                transforms.Add(transformName);  // return it\n                                continue;   // success\n                            }\n                            else\n                                throw new InvalidOperationException(SR.UnsupportedTransformAlgorithm);\n                        }\n                    }\n                }\n                throw new XmlException(SR.XmlSignatureParseError);\n            }\n\n            if (transforms.Count == 0)\n                throw new XmlException(SR.XmlSignatureParseError);\n            \n            //If we found another transform after the Relationship transform, it will be validated earlier\n            //in this method to make sure that its a supported xml canonicalization algorithm and so we can \n            //simplify this test condition - As per the OPC spec - Relationship transform must be followed\n            //by a canonicalization algorithm.\n            if (relationshipTransformFound && (transforms.Count == transformsCountWhenRelationshipTransformFound))\n                throw new XmlException(SR.RelationshipTransformNotFollowedByCanonicalizationTransform);\n\n            return transforms;\n        }","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs#L361-L397","documentation":"A non-Relationship Transform declared an Algorithm that is not one of the supported XML canonicalization algorithms recognized by XmlDigitalSignatureProcessor.IsValidXmlCanonicalizationTransform. The library throws InvalidOperationException because, per the OPC profile, the only allowed non-Relationship transform is an XML canonicalization method.","triggerScenarios":"Verify on a signature whose Transform Algorithm attribute names an unsupported method (e.g. XSLT transforms, base64 decode, exclusive C14N variants not in the allowed set, or custom algorithm URIs).","commonSituations":"Generic XMLDSig signers using standard-but-non-canonicalization transforms (XSLT, XPath filtering); signer and verifier built against different allowed-algorithm sets; custom enterprise signing pipelines.","solutions":["Change the Transform Algorithm to a supported canonicalization URI (e.g. http://www.w3.org/2001/10/xml-exc-c14n#)","Re-sign the package with PackageDigitalSignatureManager so only supported transforms are written","Remove unsupported transform steps from the signing pipeline and recompute digests accordingly","Confirm the signer and the consuming WPF build agree on the allowed C14N algorithm list"],"exampleFix":"// before\n<Transform Algorithm=\"http://www.w3.org/TR/1999/REC-xpath-19991116\"/>\n// after\n<Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"/>","handlingStrategy":"validation","validationCode":"var supported = new HashSet<string>(StringComparer.Ordinal) {\n    \"http://www.w3.org/2001/10/xml-exc-c14n#\" /* add the full allowed C14N set */ };\nconst string relNs = \"http://schemas.openxmlformats.org/package/2006/RelationshipTransform\";\nbool allSupported = doc.Descendants(ds + \"Transform\")\n    .Select(t => (string)t.Attribute(\"Algorithm\"))\n    .All(a => a == relNs || supported.Contains(a));\nif (!allSupported) throw new InvalidDataException(\"Unsupported transform algorithm\");","typeGuard":null,"tryCatchPattern":"try\n{\n    sigManager.VerifySignatures(true);\n}\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"transform\"))\n{\n    // unsupported algorithm: re-sign with allowed canonicalization only\n}","preventionTips":["Restrict signing pipelines to canonicalization transforms only","Disable XSLT/XPath filtering transforms in the signing tool config","Keep the signer's allowed-algorithm list aligned with the consuming runtime","Document the accepted algorithm URIs for signature producers"],"tags":["wpf","packaging","xml-signature","unsupported-algorithm"],"backgroundTag":"unsupported-operation","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}