{"record":{"id":"f395f651457d2fa4","repo":"dotnet/wpf","slug":"sr-partreferenceurimalformed","errorCode":null,"errorMessage":"SR.PartReferenceUriMalformed","messagePattern":"SR\\.PartReferenceUriMalformed","errorType":"exception","errorClass":"System.Xml.XmlException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs","lineNumber":608,"sourceCode":"            {\n                try\n                {\n                    // ensure it starts with the correct query prefix\n                    String query = attrValue.Substring(index);\n                    if ((query.Length > _contentTypeQueryStringPrefix.Length) && (query.StartsWith(_contentTypeQueryStringPrefix, StringComparison.Ordinal)))\n                    {\n                        // truncate the prefix and validate\n                        contentType = new ContentType(query.Substring(_contentTypeQueryStringPrefix.Length));\n}\n\n                    // now construct the uri without the query\n                    uri = PackUriHelper.ValidatePartUri(new Uri(attrValue.Substring(0, index), UriKind.Relative));\n                }\n                catch (ArgumentException ae)\n                {\n                    // Content type or part uri is malformed so we have a bad signature.\n                    // Rethrow as XmlException so outer validation loop can catch it and return validation result.\n                    throw new XmlException(SR.PartReferenceUriMalformed, ae);\n                }\n            }\n\n            // throw if we failed\n            if (contentType.ToString().Length <= 0)\n                throw new XmlException(SR.PartReferenceUriMalformed);\n\n            return uri;\n        }\n\n        /// <summary>\n        /// Generates a Reference tag that contains a Relationship transform\n        /// </summary>\n        /// <param name=\"manager\">manager</param>\n        /// <param name=\"relationshipPartName\">name of the relationship part</param>\n        /// <param name=\"xDoc\">current xml document</param>\n        /// <param name=\"hashAlgorithm\">hash algorithm = digest method</param>\n        /// <param name=\"relationshipSelectors\">relationshipSelectors that represent the relationships to sign </param>","sourceCodeStart":590,"sourceCodeEnd":626,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs#L590-L626","documentation":"ParsePartUriAttribute parses the SourceUri/ContentType attributes of a <Reference> in a signed manifest. If PackUriHelper.ValidatePartUri rejects the URI (or the derived content type is invalid), the code rethrows PartReferenceUriMalformed as an XmlException because the signature XML references a malformed part URI — meaning the signature is corrupt or non-conformant.","triggerScenarios":"Signature validation (via ParsePartUri -> ParsePartUriAttribute) encountering a <Reference> whose URI substring fails PackUriHelper.ValidatePartUri — e.g. illegal characters, absolute URIs where relative required, or invalid part name syntax.","commonSituations":"Packages signed by third-party tools writing non-canonical part names; signature XML edited or corrupted in transit; part names with characters needing escaping that weren't.","solutions":["Fix the producing tool to write valid OPC part URIs (PackUriHelper-compliant relative part names)","Validate part URIs with PackUriHelper.ValidatePartUri before writing them into signatures","Re-sign or regenerate the package from source since validation cannot proceed on a malformed reference","Treat the package signature as invalid and fall back to untrusted handling if you don't control the source"],"exampleFix":"// before (written into signature)\n<Reference SourceUri=\"http://example.com/doc.xml\" .../>\n// after (valid relative OPC part URI)\n<Reference SourceUri=\"/doc.xml\" ContentType=\"application/xml\" .../>","handlingStrategy":"try-catch","validationCode":"bool IsValidPartUri(string s) =>\n    Uri.TryCreate(s, UriKind.Relative, out var u) &&\n    TryGet(() => PackUriHelper.ValidatePartUri(u)) != null;\nstatic T TryGet<T>(Func<T> f) { try { return f(); } catch { return default; } }","typeGuard":null,"tryCatchPattern":"try { package.VerifySignatures(); }\ncatch (XmlException ex) when (ex.Message.Contains(\"malformed\") || ex.Message.Contains(\"PartReference\")) { /* mark package signature invalid */ }","preventionTips":["Use PackUriHelper.CreatePartUri/ValidatePartUri when generating part names","Never write absolute URIs into signature references","Round-trip test signatures produced by your signing tool"],"tags":["xml","packaging","uri","digital-signature"],"backgroundTag":"invalid-url-format","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}