anchor.diff:  CA3060,UseXmlReaderForSchemaRead,System.Xml,#N/A,Use XmlReader for Schema Read,"Do not use unsafe overloads of System.Xml.Schema.XmlSchema.Read. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
   CA3061,DoNotAddStringsToXmlSchema,System.Xml,#N/A,Do not add strings to Xml schema,"Do not use unsafe overloads of System.Xml.Schema.XmlSchemaCollection.Add. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
   CA3062,UseXmlReaderForValidatingReader,System.Xml,#N/A,Use XmlReader for ValidatingReader,"Configure System.Xml.XmlValidatingReader to validate the parsed XML. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  -CA3063,UseXmlReaderForDataSetReadXml,System.Data,#N/A,Use XmlReader for DataSet ReadXml,"Do not use unsafe overloads of System.Data.DataSet.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  -CA3064,UseXmlReaderForDataSetReadXmlSchema,System.Data,#N/A,Use XmlReader for DataSet ReadXmlSchema,"Do not use unsafe overloads of System.Data.DataSet.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  -CA3065,ReviewDataViewCollectionString,System.Data,#N/A,Review DataView CollectionString,"Review code to insure that usage of System.Data.DataViewManager.DataViewSettingCollectionString input is sanitized to not contain DTD. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  +CA3063,UseXmlReaderForDataSetReadXml,Desktop,#N/A,Use XmlReader for DataSet ReadXml,"Do not use unsafe overloads of System.Data.DataSet.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,High,Yes,,
  +CA3064,UseXmlReaderForDataSetReadXmlSchema,Desktop,#N/A,Use XmlReader for DataSet ReadXmlSchema,"Do not use unsafe overloads of System.Data.DataSet.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,High,Yes,,
  +CA3065,ReviewDataViewCollectionString,Desktop,#N/A,Review DataView CollectionString,"Review code to insure that usage of System.Data.DataViewManager.DataViewSettingCollectionString input is sanitized to not contain DTD. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,High,Yes,,
   CA3066,ReviewWebControlForSet_Data,System.Web,#N/A,Review WebControl for set_Data,"Review code to insure that System.Web.UI.WebControls.XmlDataSource::Data is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
   CA3067,ReviewWebControlForSet_DocumentContent,System.Web,#N/A,Review WebControl for set_DocumentContent,"Review code to insure that System.Web.UI.WebControls.Xml::DocumentContent is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
   CA3068,TextReaderImplNeedsSettingsAndResolver,System.Xml,#N/A,TextReaderImpl needs settings and resolver,"Do not use unsafe overloads of the constructor for the System.Xml.XmlTextReaderImpl. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
   CA3069,ReviewDtdProcessingAssignment,System.Xml,#N/A,Review DtdProcessing assignment,"Review all code that enables DtdProcessing to insure that it is necessary and properly documented. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
   CA3070,UseXmlReaderForDeserialize,System.Xml,#N/A,Use XmlReader for Deserialize,"Do not use unsafe overloads of System.Xml.Serialization.XmlSerializer.Deserialize. This API internally enables DTD processing on the XML reader instance used but doesn't allow external entity resolution, enabling the attacker to DoS the machine processing the XML with a single especially crafted XML input.",No,,,,,,,,,
  -CA3071,UseXmlReaderForDataTableReadXml,System.Data,#N/A,Use XmlReader for DataTable ReadXml,"Do not use unsafe overloads of System.Data.DataTable.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  -CA3072,UseXmlReaderForDataTableReadXmlSchema,System.Data,#N/A,Use XmlReader for DataTable ReadXmlSchema,"Checks for usage of an unsafe overload of  System.Data.DataTable.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
  +CA3071,UseXmlReaderForDataTableReadXml,Desktop,#N/A,Use XmlReader for DataTable ReadXml,"Do not use unsafe overloads of System.Data.DataTable.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,High,Yes,,
  +CA3072,UseXmlReaderForDataTableReadXmlSchema,Desktop,#N/A,Use XmlReader for DataTable ReadXmlSchema,"Checks for usage of an unsafe overload of  System.Data.DataTable.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,High,Yes,,
   CA3073,ReviewTrustedXsltUse,System.Xml,#N/A,Review Trusted Xslt use,"Review code to insure that System.Xml.Xsl.XsltSettings::TrustedXslt is set from a trusted source. This pattern allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,,
   CA3074,ReviewClassesDerivedFromXmlTextReader,System.Xml,#N/A,Review classes derived from XmlTextReader,"Review code to insure that  DTD prosessing is disabled on all instances of classes derived from System.Xml.XmlTextReader. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,
   CA5122,PInvokesShouldNotBeSafeCriticalFxCopRule,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,Low,,,
  
positive.code: CA1901,PInvokeDeclarationsShouldBePortable,System.Runtime.InteropServices,#N/A,PInvoke declarations should be portable,"This rule evaluates the size of each parameter and the return value of a P/Invoke, and verifies that the size of the parameter is correct when marshaled to unmanaged code on 32-bit and 64-bit operating systems.",Yes,114993,367,0.003191499,1585.672444,Portability,High,Ported,,See CA2101
  CA1903,UseOnlyApiFromTargetedFramework,System.Runtime,#N/A,Use only api from targeted framework,A member or type is using a member or type that was introduced in a service pack that was not included together with the targeted framework of the project.,Yes,114762,732,0.006378418,793.2685116,Portability,High,,,FrameworkCompatibilityService
  CA2000,DisposeObjectsBeforeLosingScope,System.Runtime,#N/A,Dispose Objects Before Losing Scope,"Because an exceptional event might occur that will prevent the finalizer of an object from running, the object should be explicitly disposed before all references to it are out of scope.",Yes,2950496,21737,0.007367236,878.1984362,Reliability,High,,,Dataflow
  CA2001,AvoidCallingProblematicMethods,Multiple,#N/A,Avoid calling problematic methods,A member calls a potentially dangerous or problematic method.,Yes,279199,1198,0.004290846,1269.193408,Reliability,High,,,None
  CA2002,DoNotLockOnObjectsWithWeakIdentity,System.Runtime,System.Runtime.Analyzers,Do not lock on objects with weak identity,An object is said to have a weak identity when it can be directly accessed across application domain boundaries. A thread that tries to acquire a lock on an object that has a weak identity can be blocked by a second thread in a different application domain that has a lock on the same object.,Yes,123953,440,0.003549733,1434.828387,Reliability,High,Ported,,
  CA2003,DoNotTreatFibersAsThreads,System.Runtime.InteropServices,#N/A,Do not treat fibers as threads,A managed thread is being treated as a Win32 thread.,Yes,34,0,0,,Reliability,Low,,,
  CA2004,RemoveCallsToGCKeepAlive,System.Runtime,#N/A,Remove calls to GC.KeepAlive,"If you convert to SafeHandle usage, remove all calls to GC.KeepAlive (object). In this case, classes should not have to call GC.KeepAlive. This assumes they do not have a finalizer but rely on SafeHandle to finalize the OS handle for them.",Yes,16938,72,0.004250797,994.8398157,Reliability,Low,,,
  CA2006,UseSafeHandleToEncapsulateNativeResources,System.Runtime.InteropServices,#N/A,Use SafeHandle to encapsulate native resources,"Use of IntPtr in managed code might indicate a potential security and reliability problem. All uses of IntPtr must be reviewed to determine whether use of a SafeHandle, or similar technology, is required in its place.",Yes,63814,334,0.005233961,918.0266694,Reliability,Low,,,
  CA2100,ReviewSqlQueriesForSecurityVulnerabilities,System.Data,#N/A,Review SQL queries for security vulnerabilities,A method sets the System.Data.IDbCommand.CommandText property by using a string that is built from a string argument to the method. This rule assumes that the string argument contains user input. A SQL command string that is built from user input is vulnerable to SQL injection attacks.,Yes,418391,3364,0.008040326,699.1734406,Security,High,,,Dataflow
  CA2101,SpecifyMarshalingForPInvokeStringArguments,System.Runtime.InteropServices,System.Runtime.InteropServices.Analyzers,Specify marshaling for PInvoke string arguments,"A platform invoke member allows partially trusted callers, has a string parameter, and does not explicitly marshal the string. This can cause a potential security vulnerability.",Yes,230439,998,0.004330864,1238.218475,Globalization,High,Ported,,
  CA2102,CatchNonClsCompliantExceptionsInGeneralHandlers,System.Runtime,#N/A,Catch non-CLSCompliant exceptions in general handlers,A member in an assembly that is not marked by using the RuntimeCompatibilityAttribute or is marked RuntimeCompatibility(WrapNonExceptionThrows = false) contains a catch block that handles System.Exception and does not contain an immediately following general catch block.,Yes,2400,11,0.004583333,737.5006346,Security,Low,,,
  CA2103,ReviewImperativeSecurity,Desktop,#N/A,Review imperative security,A method uses imperative security and might be constructing the permission by using state information or return values that can change as long as the demand is active. Use declarative security whenever possible.,Yes,11291,80,0.007085289,571.9925201,Security,Low,,,
  CA2104,DoNotDeclareReadOnlyMutableReferenceTypes,Multiple,#N/A,Do not declare read only mutable reference types,An externally visible type contains an externally visible read-only field that is a mutable reference type. A mutable type is a type whose instance data can be modified.,Yes,292444,8727,0.029841611,183.1684881,Security,Low,,,Hardcoded list of immutable types
  CA2105,ArrayFieldsShouldNotBeReadOnly,System.Runtime,#N/A,Array fields should not be read only,"When you apply the read-only (ReadOnly in Visual Basic) modifier to a field that contains an array, the field cannot be changed to reference a different array. However, the elements of the array that are stored in a read-only field can be changed.",Yes,58839,177,0.003008209,1585.549919,Security,Low,,,
  CA2106,SecureAsserts,Desktop,#N/A,Secure asserts,A method asserts a permission and no security checks are performed on the caller. Asserting a security permission without performing any security checks can leave an exploitable security weakness in your code.,Yes,13428,138,0.010277033,401.6734505,Security,Low,,,
  CA2107,ReviewDenyAndPermitOnlyUsage,Desktop,#N/A,Review deny and permit only usage,The PermitOnly method and CodeAccessPermission.Deny security actions should be used only by those who have an advanced knowledge of .NET Framework security. Code that uses these security actions should undergo a security review.,Yes,938,16,0.017057569,174.2453914,Security,Low,,,
  
negative.code: CA1505,AvoidUnmaintainableCode,Microsoft.Maintainability,#N/A,Avoid unmaintainable code,A type or method has a low maintainability index value. A low maintainability index indicates that a type or method is probably difficult to maintain and would be a good candidate for redesign.,Yes,433586,1040,0.002398601,2350.150875,Maintainability,High,,,MetricsPackage
  CA1506,AvoidExcessiveClassCoupling,Microsoft.Maintainability,#N/A,Avoid excessive class coupling,This rule measures class coupling by counting the number of unique type references that a type or method contains.,Yes,880097,3730,0.004238169,1402.617559,Maintainability,High,,,MetricsPackage
  CA1600,DoNotUseIdleProcessPriority,System.Runtime,#N/A,Do not use idle process priority,"Do not set process priority to Idle. Processes that have System.Diagnostics.ProcessPriorityClass.Idle will occupy the CPU when it would otherwise be idle, and will therefore block standby.",Yes,310,1,0.003225806,772.3221251,Mobility,Low,,,
  CA1601,DoNotUseTimersThatPreventPowerStateChanges,System.Runtime,#N/A,Do not use timers that prevent power state changes,Higher-frequency periodic activity will keep the CPU busy and interfere with power-saving idle timers that turn off the display and hard disks.,Yes,61232,189,0.003086621,1550.879704,Mobility,Low,Yes,,
  CA1700,DoNotNameEnumValuesReserved,Microsoft.ApiDesignGuidelines,#N/A,Do not name enum values 'Reserved',"This rule assumes that an enumeration member that has a name that contains """"reserved"""" is not currently used but is a placeholder to be renamed or removed in a future version. Renaming or removing a member is a breaking change.",Yes,17591,143,0.008129157,522.2301097,Naming,Low,,,
  CA1701,ResourceStringCompoundWordsShouldBeCasedCorrectly,Microsoft.ApiDesignGuidelines,#N/A,Resource string compound words should be cased correctly,"Each word in the resource string is split into tokens based on the casing. Each contiguous two-token combination is checked by the Microsoft spelling checker library. If recognized, the word produces a violation of the rule.",Yes,2530287,18776,0.007420502,862.9024959,Naming,High,,,NamingService
  CA1702,CompoundWordsShouldBeCasedCorrectly,Microsoft.ApiDesignGuidelines,#N/A,Compound words should be cased correctly,Avoid creating compound words from terms which exist in the dictionary as discrete terms. Do not create a compound word such as 'StopWatch' or 'PopUp'. These terms are recognized in the dictionary and should be cased as 'Stopwatch' and 'Popup'.,Yes,,,,,,#N/A,Cut,Deprecated rule (replaced by 1709),
  