anchor.diff:  CA909,UseFrameworksThatSatisfySecurityRequirements,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,,Cut,Deprecated rule checking for insecure/beta framework use,
   RS0001,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Use SpecializedCollections.EmptyEnumerable(),#N/A,,,,,,Performance,,Ported,,
   RS0002,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Use SpecializedCollections.SingletonEnumerable(),#N/A,,,,,,Performance,,Ported,,
  -RS0003,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not directly await a Task,#N/A,,,,,,Reliability,,Ported,,
  +RS0003,#N/A,System.Threading.Tasks,Roslyn.Diagnostics.Analyzers,Do not directly await a Task,#N/A,,,,,,Reliability,,Ported,,
   RS0004,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Invoke the correct property to ensure correct use site diagnostics.,#N/A,,,,,,Usage,,Ported,,
   RS0005,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Do not use generic CodeAction.Create to create CodeAction,#N/A,,,,,,Performance,,Ported,,
  -RS0006,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not mix attributes from different versions of MEF,#N/A,,,,,,Reliability,,Ported,,
  -RS0007,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Avoid zero-length array allocations.,#N/A,,,,,,Performance,,Ported,,
  -RS0008,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Implement IEquatable when overriding Object.Equals,#N/A,,,,,,Performance,,Ported,,
  -RS0009,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Override Object.Equals(object) when implementing Iequatable,#N/A,,,,,,Reliability,,Ported,,
  -RS0010,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Avoid using cref tags with a prefix,"Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.",,,,,,Documentation,,Ported,,
  -RS0011,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,CancellationToken parameters must come last,#N/A,,,,,,ApiDesign,,Ported,,
  -RS0012,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not call ToImmutableArray on an ImmutableArray value,#N/A,,,,,,Reliability,,Ported,,
  +RS0006,#N/A,Microsoft.Composition,Roslyn.Diagnostics.Analyzers,Do not mix attributes from different versions of MEF,#N/A,,,,,,Reliability,,Ported,,
  +RS0007,#N/A,Roslyn.Diagnostics,Roslyn.Diagnostics.Analyzers,Avoid zero-length array allocations.,#N/A,,,,,,Performance,,Ported,,
  +RS0008,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,Implement IEquatable when overriding Object.Equals,#N/A,,,,,,Performance,,Ported,,
  +RS0009,#N/A,Roslyn.Diagnostics,Roslyn.Diagnostics.Analyzers,Override Object.Equals(object) when implementing Iequatable,#N/A,,,,,,Reliability,,Ported,,
  +RS0010,#N/A,XmlDocumentationComments,Roslyn.Diagnostics.Analyzers,Avoid using cref tags with a prefix,"Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.",,,,,,Documentation,,Ported,,
  +RS0011,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,CancellationToken parameters must come last,#N/A,,,,,,ApiDesign,,Ported,,
  +RS0012,#N/A,System.Collections.Immutable,Roslyn.Diagnostics.Analyzers,Do not call ToImmutableArray on an ImmutableArray value,#N/A,,,,,,Reliability,,Ported,,
   RS0013,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Do not invoke Diagnostic.Descriptor,"Accessing the Descriptor property of Diagnostic in compiler layer leads to unnecessary string allocations for fields of the descriptor that are not utilized in command line compilation. Hence, you should avoid accessing the Descriptor of the compiler diagnostics here. Instead you should directly access these properties off the Diagnostic type.",,,,,,Performance,,Ported,,
  -RS0014,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not use Enumerable methods on indexable collections. Instead use the collection directly,This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.,,,,,,Performance,,Ported,,
  -RS0015,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Always consume the value returned by methods marked with PreserveSigAttribute,"PreserveSigAttribute indicates that a method will return an HRESULT, rather than throwing an exception. Therefore, it is important to consume the HRESULT returned by the method, so that errors can be detected. Generally, this is done by calling Marshal.ThrowExceptionForHR.",,,,,,Reliability,,Ported,,
  +RS0014,#N/A,System.Runtime,Roslyn.Diagnostics.Analyzers,Do not use Enumerable methods on indexable collections. Instead use the collection directly,This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.,,,,,,Performance,,Ported,,
  +RS0015,#N/A,System.Runtime.InteropServices,Roslyn.Diagnostics.Analyzers,Always consume the value returned by methods marked with PreserveSigAttribute,"PreserveSigAttribute indicates that a method will return an HRESULT, rather than throwing an exception. Therefore, it is important to consume the HRESULT returned by the method, so that errors can be detected. Generally, this is done by calling Marshal.ThrowExceptionForHR.",,,,,,Reliability,,Ported,,
   RS0016,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Add public types and members to the declared API,"All public types and members should be declared in PublicAPI.txt. This draws attention to API changes in the code reviews and source control history, and helps prevent breaking changes.",,,,,,ApiDesign,,Ported,,
   RS0017,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Remove deleted types and members from the declared API,"When removing a public type or member the corresponding entry in PublicAPI.txt should also be removed. This draws attention to API changes in the code reviews and source control history, and helps prevent breaking changes.",,,,,,ApiDesign,,Ported,,
  -RS0018,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not create tasks without passing a TaskScheduler,"Do not create tasks unless you are using one of the overloads that takes a TaskScheduler. The default is to schedule on TaskScheduler.Current, which would lead to deadlocks. Either use TaskScheduler.Default to schedule on the thread pool, or explicitly pass TaskScheduler.Current to make your intentions clear.",,,,,,Reliability,,Ported,,
  +RS0018,#N/A,System.Threading.Tasks,Roslyn.Diagnostics.Analyzers,Do not create tasks without passing a TaskScheduler,"Do not create tasks unless you are using one of the overloads that takes a TaskScheduler. The default is to schedule on TaskScheduler.Current, which would lead to deadlocks. Either use TaskScheduler.Default to schedule on the thread pool, or explicitly pass TaskScheduler.Current to make your intentions clear.",,,,,,Reliability,,Ported,,
   RS0019,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,SymbolDeclaredEvent must be generated for source symbols,"Compilation event queue is required to generate symbol declared events for all declared source symbols. Hence, every source symbol type or one of it's base types must generate a symbol declared event.",,,,,,Reliability,,Ported,,
  -RS0020,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,unused code,#N/A,,,,,,Maintainability,,Ported,,
  -RS0021,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Hidden (used by CodeFix),#N/A,,,,,,#N/A,,Ported,,
  -RS0022,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Constructor make noninheritable base class inheritable,"When a base class is noninheritable because its constructor is internal, a derived class should not make it inheritable by having a public or protected constructor.",,,,,,ApiDesign,,Ported,,
  -RS0023,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Parts exported with MEFv2 must be marked as Shared,#N/A,,,,,,Reliability,,Ported,,
  +RS0020,#N/A,FixMe,Roslyn.Diagnostics.Analyzers,unused code,#N/A,,,,,,Maintainability,,Ported,,
  +RS0021,#N/A,FixMe,Roslyn.Diagnostics.Analyzers,Hidden (used by CodeFix),#N/A,,,,,,#N/A,,Ported,,
  +RS0022,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,Constructor make noninheritable base class inheritable,"When a base class is noninheritable because its constructor is internal, a derived class should not make it inheritable by having a public or protected constructor.",,,,,,ApiDesign,,Ported,,
  +RS0023,#N/A,Microsoft.Composition,Roslyn.Diagnostics.Analyzers,Parts exported with MEFv2 must be marked as Shared,#N/A,,,,,,Reliability,,Ported,,
   RS0024,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,The contents of the public API files are invalid,#N/A,,,,,,ApiDesign,,Ported,,
  -RS1001,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Missing diagnostic analyzer attribute,"Non-abstract sub-types of DiagnosticAnalyzer should be marked with DiagnosticAnalyzerAttribute(s). The argument to this attribute(s), if any, determine the supported languages for the analyzer. Analyzer types without this attribute will be ignored by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  -RS1002,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Missing kind argument while registering an analyzer action,"You must specify at least one syntax/symbol kinds of interest while registering a syntax/symbol analyzer action. Otherwise, the registered action will be dead code and will never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  -RS1003,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Unsupported SymbolKind argument while registering a symbol analyzer action,#N/A,,,,,,AnalyzerCorrectness,,,,
  -RS1004,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Recommend adding language support to diagnostic analyzer,"Diagnostic analyzer is marked as supporting only one language, but the analyzer assembly doesn't seem to refer to any language specific CodeAnalysis assemblies, and so is likely to work for more than one language. Consider adding an additional language argument to DiagnosticAnalyzerAttribute.",,,,,,AnalyzerCorrectness,,,,
  -RS1005,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,ReportDiagnostic invoked with an unsupported DiagnosticDescriptor,"ReportDiagnostic should only be invoked with supported DiagnosticDescriptors that are returned from DiagnosticAnalyzer.SupportedDiagnostics property. Otherwise, the reported diagnostic will be filtered out by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  -RS1006,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Invalid type argument for DiagnosticAnalyzer's Register method,"DiagnosticAnalyzer's language-specific Register methods, such as RegisterSyntaxNodeAction, RegisterCodeBlockStartAction and RegisterCodeBlockEndAction, expect a language-specific 'SyntaxKind' type argument for it's 'TLanguageKindEnumName' type parameter. Otherwise, the registered analyzer action can never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  -RS1007,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Provide localizable arguments to diagnostic descriptor constructor,"If your diagnostic analyzer and it's reported diagnostics need to be localizable, then the supported DiagnosticDescriptors used for constructing the diagnostics must also be localizable. If so, then localizable argument(s) must be provided for parameter 'title' (and optionally 'description') to the diagnostic descriptor constructor to ensure that the descriptor is localizable.",,,,,,AnalyzerLocalization,,,,
  -RS1008,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Avoid storing per-compilation data into the fields of a diagnostic analyzer,"Instance of a diagnostic analyzer might outlive the lifetime of compilation. Hence, storing per-compilation data, such as symbols, into the fields of a diagnostic analyzer might cause stale compilations to stay alive and cause memory leaks. Instead, you should store this data on a separate type instantiated in a compilation start action, registered using 'AnalysisContext.RegisterCompilationStartAction' API. An instance of this type will be created per-compilation and it won't outlive compilation's lifetime, hence avoiding memory leaks.",,,,,,AnalyzerPerformance,,,,
  -RS1009,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Only internal implementations of this interface are allowed,The author of this interface did not intend to have third party implementations of this interface and reserves the right to change it. Implementing this interface could therefore result in a source or binary compatibility issue with a future version of this interface.,,,,,,Compatibility,,,,
  -RS1010,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Create code actions should have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  -RS1011,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Use code actions that have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  -RS1012,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Start action has no registered actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  -RS1013,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Start action has no registered non-end actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  +RS1001,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Missing diagnostic analyzer attribute,"Non-abstract sub-types of DiagnosticAnalyzer should be marked with DiagnosticAnalyzerAttribute(s). The argument to this attribute(s), if any, determine the supported languages for the analyzer. Analyzer types without this attribute will be ignored by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  +RS1002,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Missing kind argument while registering an analyzer action,"You must specify at least one syntax/symbol kinds of interest while registering a syntax/symbol analyzer action. Otherwise, the registered action will be dead code and will never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  +RS1003,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Unsupported SymbolKind argument while registering a symbol analyzer action,#N/A,,,,,,AnalyzerCorrectness,,,,
  +RS1004,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Recommend adding language support to diagnostic analyzer,"Diagnostic analyzer is marked as supporting only one language, but the analyzer assembly doesn't seem to refer to any language specific CodeAnalysis assemblies, and so is likely to work for more than one language. Consider adding an additional language argument to DiagnosticAnalyzerAttribute.",,,,,,AnalyzerCorrectness,,,,
  +RS1005,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,ReportDiagnostic invoked with an unsupported DiagnosticDescriptor,"ReportDiagnostic should only be invoked with supported DiagnosticDescriptors that are returned from DiagnosticAnalyzer.SupportedDiagnostics property. Otherwise, the reported diagnostic will be filtered out by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  +RS1006,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Invalid type argument for DiagnosticAnalyzer's Register method,"DiagnosticAnalyzer's language-specific Register methods, such as RegisterSyntaxNodeAction, RegisterCodeBlockStartAction and RegisterCodeBlockEndAction, expect a language-specific 'SyntaxKind' type argument for it's 'TLanguageKindEnumName' type parameter. Otherwise, the registered analyzer action can never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  +RS1007,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Provide localizable arguments to diagnostic descriptor constructor,"If your diagnostic analyzer and it's reported diagnostics need to be localizable, then the supported DiagnosticDescriptors used for constructing the diagnostics must also be localizable. If so, then localizable argument(s) must be provided for parameter 'title' (and optionally 'description') to the diagnostic descriptor constructor to ensure that the descriptor is localizable.",,,,,,AnalyzerLocalization,,,,
  +RS1008,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Avoid storing per-compilation data into the fields of a diagnostic analyzer,"Instance of a diagnostic analyzer might outlive the lifetime of compilation. Hence, storing per-compilation data, such as symbols, into the fields of a diagnostic analyzer might cause stale compilations to stay alive and cause memory leaks. Instead, you should store this data on a separate type instantiated in a compilation start action, registered using 'AnalysisContext.RegisterCompilationStartAction' API. An instance of this type will be created per-compilation and it won't outlive compilation's lifetime, hence avoiding memory leaks.",,,,,,AnalyzerPerformance,,,,
  +RS1009,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Only internal implementations of this interface are allowed,The author of this interface did not intend to have third party implementations of this interface and reserves the right to change it. Implementing this interface could therefore result in a source or binary compatibility issue with a future version of this interface.,,,,,,Compatibility,,,,
  +RS1010,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Create code actions should have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  +RS1011,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Use code actions that have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  +RS1012,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Start action has no registered actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  +RS1013,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Start action has no registered non-end actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  
positive.code: CA3060,UseXmlReaderForSchemaRead,System.Xml,#N/A,Use XmlReader for Schema Read,"Do not use unsafe overloads of System.Xml.Schema.XmlSchema.Read. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3061,DoNotAddStringsToXmlSchema,System.Xml,#N/A,Do not add strings to Xml schema,"Do not use unsafe overloads of System.Xml.Schema.XmlSchemaCollection.Add. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3062,UseXmlReaderForValidatingReader,System.Xml,#N/A,Use XmlReader for ValidatingReader,"Configure System.Xml.XmlValidatingReader to validate the parsed XML. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3063,UseXmlReaderForDataSetReadXml,System.Data,#N/A,Use XmlReader for DataSet ReadXml,"Do not use unsafe overloads of System.Data.DataSet.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3064,UseXmlReaderForDataSetReadXmlSchema,System.Data,#N/A,Use XmlReader for DataSet ReadXmlSchema,"Do not use unsafe overloads of System.Data.DataSet.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3065,ReviewDataViewCollectionString,System.Data,#N/A,Review DataView CollectionString,"Review code to insure that usage of System.Data.DataViewManager.DataViewSettingCollectionString input is sanitized to not contain DTD. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3066,ReviewWebControlForSet_Data,System.Web,#N/A,Review WebControl for set_Data,"Review code to insure that System.Web.UI.WebControls.XmlDataSource::Data is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3067,ReviewWebControlForSet_DocumentContent,System.Web,#N/A,Review WebControl for set_DocumentContent,"Review code to insure that System.Web.UI.WebControls.Xml::DocumentContent is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3068,TextReaderImplNeedsSettingsAndResolver,System.Xml,#N/A,TextReaderImpl needs settings and resolver,"Do not use unsafe overloads of the constructor for the System.Xml.XmlTextReaderImpl. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3069,ReviewDtdProcessingAssignment,System.Xml,#N/A,Review DtdProcessing assignment,"Review all code that enables DtdProcessing to insure that it is necessary and properly documented. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3070,UseXmlReaderForDeserialize,System.Xml,#N/A,Use XmlReader for Deserialize,"Do not use unsafe overloads of System.Xml.Serialization.XmlSerializer.Deserialize. This API internally enables DTD processing on the XML reader instance used but doesn't allow external entity resolution, enabling the attacker to DoS the machine processing the XML with a single especially crafted XML input.",No,,,,,,,,,
  CA3071,UseXmlReaderForDataTableReadXml,System.Data,#N/A,Use XmlReader for DataTable ReadXml,"Do not use unsafe overloads of System.Data.DataTable.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3072,UseXmlReaderForDataTableReadXmlSchema,System.Data,#N/A,Use XmlReader for DataTable ReadXmlSchema,"Checks for usage of an unsafe overload of  System.Data.DataTable.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA3073,ReviewTrustedXsltUse,System.Xml,#N/A,Review Trusted Xslt use,"Review code to insure that System.Xml.Xsl.XsltSettings::TrustedXslt is set from a trusted source. This pattern allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,,
  CA3074,ReviewClassesDerivedFromXmlTextReader,System.Xml,#N/A,Review classes derived from XmlTextReader,"Review code to insure that  DTD prosessing is disabled on all instances of classes derived from System.Xml.XmlTextReader. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  CA5122,PInvokesShouldNotBeSafeCriticalFxCopRule,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,Low,,,
  
negative.code: CA1505,AvoidUnmaintainableCode,Microsoft.Maintainability,#N/A,Avoid unmaintainable code,A type or method has a low maintainability index value. A low maintainability index indicates that a type or method is probably difficult to maintain and would be a good candidate for redesign.,Yes,433586,1040,0.002398601,2350.150875,Maintainability,High,,,MetricsPackage
  CA1506,AvoidExcessiveClassCoupling,Microsoft.Maintainability,#N/A,Avoid excessive class coupling,This rule measures class coupling by counting the number of unique type references that a type or method contains.,Yes,880097,3730,0.004238169,1402.617559,Maintainability,High,,,MetricsPackage
  CA1600,DoNotUseIdleProcessPriority,System.Runtime,#N/A,Do not use idle process priority,"Do not set process priority to Idle. Processes that have System.Diagnostics.ProcessPriorityClass.Idle will occupy the CPU when it would otherwise be idle, and will therefore block standby.",Yes,310,1,0.003225806,772.3221251,Mobility,Low,,,
  CA1601,DoNotUseTimersThatPreventPowerStateChanges,System.Runtime,#N/A,Do not use timers that prevent power state changes,Higher-frequency periodic activity will keep the CPU busy and interfere with power-saving idle timers that turn off the display and hard disks.,Yes,61232,189,0.003086621,1550.879704,Mobility,Low,Yes,,
  CA1700,DoNotNameEnumValuesReserved,Microsoft.ApiDesignGuidelines,#N/A,Do not name enum values 'Reserved',"This rule assumes that an enumeration member that has a name that contains """"reserved"""" is not currently used but is a placeholder to be renamed or removed in a future version. Renaming or removing a member is a breaking change.",Yes,17591,143,0.008129157,522.2301097,Naming,Low,,,
  CA1701,ResourceStringCompoundWordsShouldBeCasedCorrectly,Microsoft.ApiDesignGuidelines,#N/A,Resource string compound words should be cased correctly,"Each word in the resource string is split into tokens based on the casing. Each contiguous two-token combination is checked by the Microsoft spelling checker library. If recognized, the word produces a violation of the rule.",Yes,2530287,18776,0.007420502,862.9024959,Naming,High,,,NamingService
  CA1702,CompoundWordsShouldBeCasedCorrectly,Microsoft.ApiDesignGuidelines,#N/A,Compound words should be cased correctly,Avoid creating compound words from terms which exist in the dictionary as discrete terms. Do not create a compound word such as 'StopWatch' or 'PopUp'. These terms are recognized in the dictionary and should be cased as 'Stopwatch' and 'Popup'.,Yes,,,,,,#N/A,Cut,Deprecated rule (replaced by 1709),
  