{"record":{"id":"7a5a335e8c639f19","repo":"dotnet/wpf","slug":"sr-unsupportedcanonicalizationmethod","errorCode":null,"errorMessage":"SR.UnsupportedCanonicalizationMethod","messagePattern":"SR\\.UnsupportedCanonicalizationMethod","errorType":"exception","errorClass":"XmlException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs","lineNumber":653,"sourceCode":"                            node = nodeList[1];\n                        }\n\n                        if ((node.NodeType != XmlNodeType.Element) ||\n                           (!string.Equals(node.NamespaceURI, SignedXml.XmlDsigNamespaceUrl, StringComparison.Ordinal)) ||\n                           (!string.Equals(node.LocalName, XTable.Get(XTable.ID.SignatureTagName), StringComparison.Ordinal)))\n                        {\n                            throw new XmlException(SR.PackageSignatureCorruption);\n                        }\n\n                        // instantiate the SignedXml from the xmlDoc\n                        _signedXml.LoadXml((XmlElement)node);\n                    }\n                }\n            }\n\n            // As per the OPC spec, only two Canonicalization methods can be specified            \n            if (!IsValidXmlCanonicalizationTransform(_signedXml.SignedInfo.CanonicalizationMethod))\n                throw new XmlException(SR.UnsupportedCanonicalizationMethod);\n\n            // As per OPC spec, signature ID must be NCName\n            if (_signedXml.Signature.Id != null)\n            {\n                try\n                {\n                    System.Xml.XmlConvert.VerifyNCName(_signedXml.Signature.Id);\n                }\n                catch (System.Xml.XmlException)\n                {\n                    throw new XmlException(SR.PackageSignatureCorruption);\n                }\n            }\n\n            return _signedXml;\n        }\n\n        //------------------------------------------------------","sourceCodeStart":635,"sourceCodeEnd":671,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs#L635-L671","documentation":"Per the OPC spec only two canonicalization methods are allowed in a package signature's SignedInfo. EnsureXmlSignatureParsed checks SignedInfo.CanonicalizationMethod against IsValidXmlCanonicalizationTransform and throws XmlException(SR.UnsupportedCanonicalizationMethod) for any other method.","triggerScenarios":"Verifying a package signature whose <CanonicalizationMethod Algorithm=...> is not one of the two OPC-permitted canonicalization algorithms (e.g. exclusive C14N where only inclusive variants are accepted, or a custom algorithm URI).","commonSituations":"Signatures generated by other stacks (Java security toolkits, XAdES signers, OpenSSL-based tools) defaulting to xml-exc-c14n; changing canonicalization settings in a signing service; cross-platform document signing workflows verified in WPF.","solutions":["Re-sign the package using an OPC-supported canonicalization method (set SignedInfo.CanonicalizationMethod to an approved algorithm, e.g. XmlDsigC14NTransform).","Edit the CanonicalizationMethod Algorithm URI in the signature part to a supported value (only valid if you can recompute signatures).","Verify with a full .NET XmlDigitalSignature stack or third-party library that supports the method used.","Configure the signing component to restrict canonicalization to the OPC-permitted algorithms."],"exampleFix":"// before (signing code)\nsignedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;\n// after\nsignedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigC14NTransformUrl;","handlingStrategy":"validation","validationCode":"var c14n = doc.SelectSingleNode(\"//*[local-name()='SignedInfo']/*[local-name()='CanonicalizationMethod']/@Algorithm\")?.Value;\nbool c14nOk = c14n == \"http://www.w3.org/TR/2001/REC-xml-c14n-20010315\"\n           || c14n == \"http://www.w3.org/2006/12/xml-c14n11\"; // OPC-permitted methods","typeGuard":null,"tryCatchPattern":"try { dsm.VerifySignatures(); }\ncatch (XmlException ex) when (ex.Message.Contains(\"Canonicalization\")) { /* verify with a full XML-DSig stack instead */ }","preventionTips":["Configure signers to use OPC-approved canonicalization","Pre-check CanonicalizationMethod Algorithm URIs","Restrict third-party signing services to OPC-compatible settings"],"tags":["wpf","xml-dsig","canonicalization","signatures"],"backgroundTag":"unsupported-enum-value","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}