{"record":{"id":"4e28f969ea2ba1d5","repo":"dotnet/wpf","slug":"sr-xmlsignatureparseerror-xmlsignaturemanifest","errorCode":null,"errorMessage":"SR.XmlSignatureParseError","messagePattern":"SR\\.XmlSignatureParseError","errorType":"exception","errorClass":"XmlException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs","lineNumber":159,"sourceCode":"                    throw new XmlException(SR.Format(SR.UnexpectedXmlTag, reader.Name));\n            }\n\n            // XmlDSig xsd requires at least one <Reference> tag\n            if (referenceCount == 0)\n                throw new XmlException(SR.PackageSignatureCorruption);\n        }\n\n        /// <summary>\n        /// Parse the DigestMethod tag\n        /// </summary>\n        /// <param name=\"reader\"></param>\n        private static string ParseDigestAlgorithmTag(XmlReader reader)\n        {\n            // verify namespace and lack of attributes\n            if (PackagingUtilities.GetNonXmlnsAttributeCount(reader) > 1\n                || !string.Equals(reader.NamespaceURI, SignedXml.XmlDsigNamespaceUrl, StringComparison.Ordinal)\n                || reader.Depth != 3)\n                throw new XmlException(SR.XmlSignatureParseError);\n\n            // get the Algorithm attribute\n            string hashAlgorithm = null;\n            if (reader.HasAttributes)\n            {\n                hashAlgorithm = reader.GetAttribute(XTable.Get(XTable.ID.AlgorithmAttrName));\n            }\n\n            if (hashAlgorithm == null || hashAlgorithm.Length == 0)\n                throw new XmlException(SR.UnsupportedHashAlgorithm);\n\n            return hashAlgorithm;\n        }\n\n        /// <summary>\n        /// Parse the DigestValue tag\n        /// </summary>\n        /// <param name=\"reader\"></param>","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs#L141-L177","documentation":"System.IO.Packaging throws this XmlException when the <DigestMethod> element inside a signature's <Reference> fails structural validation: it carries non-xmlns attributes beyond the Algorithm attribute, is not in the XMLDSig namespace (http://www.w3.org/2000/09/xmldsig#), or appears at the wrong XML depth (must be depth 3). The manifest parser rejects the signature XML as malformed.","triggerScenarios":"ParseReference -> ParseDigestAlgorithmTag encounters a <DigestMethod> whose NamespaceURI differs from SignedXml.XmlDsigNamespaceUrl, whose depth is not 3, or with more than one non-xmlns attribute (GetNonXmlnsAttributeCount > 1).","commonSituations":"Signatures produced by tools that emit DigestMethod in a custom namespace or with extra custom attributes; wrappers re-serialize the signature XML and nest the element at the wrong level; namespaces re-declared or prefixed incorrectly during round-tripping of the package.","solutions":["Ensure the signature XML's <DigestMethod> is in the http://www.w3.org/2000/09/xmldsig# namespace and sits as a direct child of <Reference> (depth 3)","Remove any non-xmlns attributes other than Algorithm from the <DigestMethod> element","Re-sign the package with PackageDigitalSignatureManager instead of hand-generating or post-processing the signature XML","If a third-party tool produced the signature, configure or replace the tool so it emits standards-compliant XMLDSig"],"exampleFix":"// before\n// <DigestMethod xmlns=\"http://custom.example/ns\" Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\" Extra=\"x\"/>\n// after\n// <DigestMethod Algorithm=\"http://www.w3.org/2001/04/xmlenc#sha256\"/> (inherited xmldsig namespace)","handlingStrategy":"validation","validationCode":"var doc = XDocument.Load(signaturePartStream);\nXNamespace ds = \"http://www.w3.org/2000/09/xmldsig#\";\nbool ok = doc.Descendants(ds + \"DigestMethod\")\n    .All(dm => dm.Parent?.Name == ds + \"Reference\"\n        && dm.Attributes().Count(a => !a.IsNamespaceDeclaration) == 1\n        && dm.Attribute(\"Algorithm\") != null);\nif (!ok) throw new InvalidDataException(\"DigestMethod element is non-conformant\");","typeGuard":null,"tryCatchPattern":"try { var sigUri = ParseSignature(xmlStream); }\ncatch (XmlException ex) when (ex.Message.Contains(\"XmlSignatureParseError\"))\n{\n    // reject the signature XML as malformed\n}","preventionTips":["Keep DigestMethod in the default xmldsig namespace with only an Algorithm attribute","Avoid XML round-trips that re-declare namespaces or add attributes to signature elements","Use standards-compliant signing tools"],"tags":["xml","digital-signature","packaging","wpf","namespace"],"backgroundTag":"xml-parse-error","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}