Signatures cover bytes, while formats like XML, JSON and e-mail allow many byte encodings of the same content. Canonicalization schemes fix one: Exclusive XML Canonicalization for XML-DSig and SAML; the JSON Canonicalization Scheme (JCS, RFC 8785: sorted keys, ECMAScript number formatting, no whitespace) for JSON; DKIM's simple and relaxed algorithms for mail headers and bodies (RFC 6376 §3.4); DER as the canonical form of ASN.1.
Every canonicalization is an attack surface, because signer and verifier must implement it identically and the application must act on the canonical content rather than the raw input; XML signature wrapping and DKIM body-length tricks both exploit gaps there. Formats such as JWS and COSE sidestep the problem by signing the exact transmitted bytes (base64url(header).base64url(payload)), which is why they are easier to get right.