anchor.diff:  CA2241,ProvideCorrectArgumentsToFormattingMethods,System.Runtime,#N/A,Provide correct arguments to formatting methods,"The format argument that is passed to System.String.Format does not contain a format item that corresponds to each object argument, or vice versa.",Yes,275305,236,0.000857231,6345.796697,Usage,,High,Yes,,,Dataflow
   CA2242,TestForNaNCorrectly,System.Runtime,#N/A,Test for NaN correctly,This expression tests a value against Single.Nan or Double.Nan. Use Single.IsNan(Single) or Double.IsNan(Double) to test the value.,Yes,15800,4,0.000253165,16584.69549,Usage,,High,Yes,,,IOperation
   CA2243,AttributeStringLiteralsShouldParseCorrectly,System.Runtime,#N/A,Attribute string literals should parse correctly,"The string literal parameter of an attribute does not parse correctly for a URL, a GUID, or a version.",Yes,63488,553,0.008710307,551.3802662,Usage,,High,Yes,,,WordParser
  -CA3050,DoNotUseXslTransform,System.Xml,#N/A,Do not use XslTransform,"Do not use obsolete and unsafe System.Xml.Xsl.XslTransform API. This API allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,,,,
  -CA3053,UseXmlSecureResolver,System.Xml,#N/A,Use XmlSecureResolver,"Review code to ensure that external resource resolution is explicitly disabled or a XmlSecureResolver is used when processing untrusted input (the resolver used internally on some overloaded methods is not safe to use on untrusted input). Using default resolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3054,DoNotAllowDtdOnXmlTextReader,System.Xml,#N/A,Do not allow Dtd on XmlTextReader,"Prohibit DTD processing when using XmlTextReader on untrusted sources. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3055,DoNotAllowDtdOnXmlReader,System.Xml,#N/A,Do not allow Dtd on XmlReader,"Prohibit DTD processing when using XmlReader on untrusted sources. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3056,UseXmlReaderForLoad,System.Xml,#N/A,Use XmlReader for Load,"Do not use unsafe overloads of System.Xml.XmlDocument/XmlDataDocument Load. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3057,DoNotUseLoadXml,System.Xml,#N/A,Do not use LoadXml,"Do not use unsafe overloads of System.Xml.XmlDocument/XmlDataDocument LoadXml API. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3058,DoNotUseSetInnerXml,System.Xml,#N/A,Do not use SetInnerXml,"Do not use the unsafe setter of InnerXml property of System.Xml.XmlDocument/XmlDataDocument. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3059,UseXmlReaderForXPathDocument,System.Xml,#N/A,Use XmlReader for XPathDocument,"Do not use unsafe overloads of the constructor for System.Xml.XPath.Xpath.XPathDocument. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3060,UseXmlReaderForSchemaRead,System.Xml,#N/A,Use XmlReader for Schema Read,"Do not use unsafe overloads of System.Xml.Schema.XmlSchema.Read. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3061,DoNotAddStringsToXmlSchema,System.Xml,#N/A,Do not add strings to Xml schema,"Do not use unsafe overloads of System.Xml.Schema.XmlSchemaCollection.Add. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3062,UseXmlReaderForValidatingReader,System.Xml,#N/A,Use XmlReader for ValidatingReader,"Configure System.Xml.XmlValidatingReader to validate the parsed XML. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  +CA3050,DoNotUseXslTransform,System.Xml,#N/A,Do not use XslTransform,"Do not use obsolete and unsafe System.Xml.Xsl.XslTransform API. This API allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3053,UseXmlSecureResolver,System.Xml,#N/A,Use XmlSecureResolver,"Review code to ensure that external resource resolution is explicitly disabled or a XmlSecureResolver is used when processing untrusted input (the resolver used internally on some overloaded methods is not safe to use on untrusted input). Using default resolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3054,DoNotAllowDtdOnXmlTextReader,System.Xml,#N/A,Do not allow Dtd on XmlTextReader,"Prohibit DTD processing when using XmlTextReader on untrusted sources. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3055,DoNotAllowDtdOnXmlReader,System.Xml,#N/A,Do not allow Dtd on XmlReader,"Prohibit DTD processing when using XmlReader on untrusted sources. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3056,UseXmlReaderForLoad,System.Xml,#N/A,Use XmlReader for Load,"Do not use unsafe overloads of System.Xml.XmlDocument/XmlDataDocument Load. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3057,DoNotUseLoadXml,System.Xml,#N/A,Do not use LoadXml,"Do not use unsafe overloads of System.Xml.XmlDocument/XmlDataDocument LoadXml API. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3058,DoNotUseSetInnerXml,System.Xml,#N/A,Do not use SetInnerXml,"Do not use the unsafe setter of InnerXml property of System.Xml.XmlDocument/XmlDataDocument. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3059,UseXmlReaderForXPathDocument,System.Xml,#N/A,Use XmlReader for XPathDocument,"Do not use unsafe overloads of the constructor for System.Xml.XPath.Xpath.XPathDocument. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3060,UseXmlReaderForSchemaRead,System.Xml,#N/A,Use XmlReader for Schema Read,"Do not use unsafe overloads of System.Xml.Schema.XmlSchema.Read. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3061,DoNotAddStringsToXmlSchema,System.Xml,#N/A,Do not add strings to Xml schema,"Do not use unsafe overloads of System.Xml.Schema.XmlSchemaCollection.Add. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3062,UseXmlReaderForValidatingReader,System.Xml,#N/A,Use XmlReader for ValidatingReader,"Configure System.Xml.XmlValidatingReader to validate the parsed XML. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
   CA3063,UseXmlReaderForDataSetReadXml,Desktop,#N/A,Use XmlReader for DataSet ReadXml,"Do not use unsafe overloads of System.Data.DataSet.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
   CA3064,UseXmlReaderForDataSetReadXmlSchema,Desktop,#N/A,Use XmlReader for DataSet ReadXmlSchema,"Do not use unsafe overloads of System.Data.DataSet.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
   CA3065,ReviewDataViewCollectionString,Desktop,#N/A,Review DataView CollectionString,"Review code to insure that usage of System.Data.DataViewManager.DataViewSettingCollectionString input is sanitized to not contain DTD. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
  -CA3066,ReviewWebControlForSet_Data,System.Web,#N/A,Review WebControl for set_Data,"Review code to insure that System.Web.UI.WebControls.XmlDataSource::Data is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3067,ReviewWebControlForSet_DocumentContent,System.Web,#N/A,Review WebControl for set_DocumentContent,"Review code to insure that System.Web.UI.WebControls.Xml::DocumentContent is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3068,TextReaderImplNeedsSettingsAndResolver,System.Xml,#N/A,TextReaderImpl needs settings and resolver,"Do not use unsafe overloads of the constructor for the System.Xml.XmlTextReaderImpl. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3069,ReviewDtdProcessingAssignment,System.Xml,#N/A,Review DtdProcessing assignment,"Review all code that enables DtdProcessing to insure that it is necessary and properly documented. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA3070,UseXmlReaderForDeserialize,System.Xml,#N/A,Use XmlReader for Deserialize,"Do not use unsafe overloads of System.Xml.Serialization.XmlSerializer.Deserialize. This API internally enables DTD processing on the XML reader instance used but doesn't allow external entity resolution, enabling the attacker to DoS the machine processing the XML with a single especially crafted XML input.",No,,,,,,,,,,,
  +CA3066,ReviewWebControlForSet_Data,System.Web,#N/A,Review WebControl for set_Data,"Review code to insure that System.Web.UI.WebControls.XmlDataSource::Data is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,@michaelcfanning to review,
  +CA3067,ReviewWebControlForSet_DocumentContent,System.Web,#N/A,Review WebControl for set_DocumentContent,"Review code to insure that System.Web.UI.WebControls.Xml::DocumentContent is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,@michaelcfanning to review,
  +CA3068,TextReaderImplNeedsSettingsAndResolver,System.Xml,#N/A,TextReaderImpl needs settings and resolver,"Do not use unsafe overloads of the constructor for the System.Xml.XmlTextReaderImpl. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3069,ReviewDtdProcessingAssignment,System.Xml,#N/A,Review DtdProcessing assignment,"Review all code that enables DtdProcessing to insure that it is necessary and properly documented. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3070,UseXmlReaderForDeserialize,System.Xml,#N/A,Use XmlReader for Deserialize,"Do not use unsafe overloads of System.Xml.Serialization.XmlSerializer.Deserialize. This API internally enables DTD processing on the XML reader instance used but doesn't allow external entity resolution, enabling the attacker to DoS the machine processing the XML with a single especially crafted XML input.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
   CA3071,UseXmlReaderForDataTableReadXml,Desktop,#N/A,Use XmlReader for DataTable ReadXml,"Do not use unsafe overloads of System.Data.DataTable.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
   CA3072,UseXmlReaderForDataTableReadXmlSchema,Desktop,#N/A,Use XmlReader for DataTable ReadXmlSchema,"Checks for usage of an unsafe overload of  System.Data.DataTable.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
  -CA3073,ReviewTrustedXsltUse,System.Xml,#N/A,Review Trusted Xslt use,"Review code to insure that System.Xml.Xsl.XsltSettings::TrustedXslt is set from a trusted source. This pattern allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,,,,
  -CA3074,ReviewClassesDerivedFromXmlTextReader,System.Xml,#N/A,Review classes derived from XmlTextReader,"Review code to insure that  DTD prosessing is disabled on all instances of classes derived from System.Xml.XmlTextReader. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,,,,
  -CA5122,PInvokesShouldNotBeSafeCriticalFxCopRule,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,,Low,,,,
  +CA3073,ReviewTrustedXsltUse,System.Xml,#N/A,Review Trusted Xslt use,"Review code to insure that System.Xml.Xsl.XsltSettings::TrustedXslt is set from a trusted source. This pattern allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA3074,ReviewClassesDerivedFromXmlTextReader,System.Xml,#N/A,Review classes derived from XmlTextReader,"Review code to insure that  DTD prosessing is disabled on all instances of classes derived from System.Xml.XmlTextReader. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  +CA5122,PInvokesShouldNotBeSafeCriticalFxCopRule,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,,Low,No,,,
   CA5350,DoNotUseWeakCryptographicAlgorithms,System.Security.Cryptography.Algorithms,#N/A,Do Not Use Weak Cryptographic Algorithms,"Cryptographic algorithms degrade over time as attacks become for advances to attacker get access to more computation. Depending on the type and application of this cryptographic algorithm, further degradation of the cryptographic strength of it may allow attackers to read enciphered messages, tamper with enciphered? messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA-2 512, SHA-2 384, or SHA-2 256.",No,,,,,,,,Ported,,,
   CA5351,DoNotUseBrokenCryptographicAlgorithms,System.Security.Cryptography.Algorithms,#N/A,Do Not Use Broken Cryptographic Algorithms,"An attack making it computationally feasible to break this algorithm exists. This allows attackers to break the cryptographic guarantees it is designed to provide. Depending on the type and application of this cryptographic algorithm, this may allow attackers to read enciphered messages, tamper with enciphered? messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA512, SHA384, or SHA256. Replace digital signature uses with RSA with a key length greater than or equal to 2048-bits, or ECDSA with a key length greater than or equal to 256 bits.",No,,,,,,,,Ported,,,
   CA5352,RC2CannotBeUsed,System.Security.Cryptography.Algorithms,#N/A,Do not use RC2,RC2 is banned by SDL,No,,,,,,,,No,,merged into CA5351,
  
positive.code: CA1300,SpecifyMessageBoxOptions,Desktop,#N/A,Specify MessageBoxOptions,"To correctly display a message box for cultures that use a right-to-left reading order, the RightAlign and RtlReading members of the MessageBoxOptions enumeration must be passed to the Show method.",Yes,283590,2427,0.00855813,637.1358121,Globalization,,Low,Yes,,,None
  CA1301,AvoidDuplicateAccelerators,Desktop,#N/A,Avoid duplicate accelerators,"An access key, also known as an accelerator, enables keyboard access to a control by using the ALT key. When multiple controls have duplicate access keys, the behavior of the access key is not well defined.",Yes,2707,16,0.005910602,580.7341068,Globalization,,Low,Yes,,,
  CA1302,DoNotHardcodeLocaleSpecificStrings,Desktop,#N/A,Do not hardcode locale specific strings,"The System.Environment.SpecialFolder enumeration contains members that refer to special system folders. The locations of these folders can have different values on different operating systems; the user can change some of the locations; and the locations are localized. The Environment.GetFolderPath method returns the locations that are associated with the Environment.SpecialFolder enumeration, localized and appropriate for the currently running computer.",Yes,13519,71,0.005251868,786.5667551,Globalization,,Low,No,,,
  CA1303,DoNotPassLiteralsAsLocalizedParameters,System.Runtime,#N/A,Do not pass literals as localized parameters,"An externally visible method passes a string literal as a parameter to a constructor or method in the .NET Framework class library, and that string should be localizable.",Yes,1370581,20484,0.014945487,410.6192633,Globalization,,Low,Yes,,,Dataflow
  CA1304,SpecifyCultureInfo,System.Runtime,#N/A,Specify CultureInfo,"A method or constructor calls a member that has an overload that accepts a System.Globalization.CultureInfo parameter, and the method or constructor does not call the overload that takes the CultureInfo parameter. When a CultureInfo or System.IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales.",Yes,1301330,3995,0.003069936,1991.698576,Globalization,,High,Yes,,,None
  CA1305,SpecifyIFormatProvider,System.Runtime,#N/A,Specify IFormatProvider,"A method or constructor calls one or more members that have overloads that accept a System.IFormatProvider parameter, and the method or constructor does not call the overload that takes the IFormatProvider parameter. When a System.Globalization.CultureInfo or IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales.",Yes,3114669,26486,0.008503632,763.6044986,Globalization,,High,Yes,,,None
  CA1306,SetLocaleForDataTypes,Desktop,#N/A,Set locale for data types,"The locale determines culture-specific presentation elements for data, such as formatting that is used for numeric values, currency symbols, and sort order. When you create a DataTable or DataSet, you should explicitly set the locale.",Yes,486816,1204,0.002473214,2299.584887,Globalization,,Low,Yes,,,Dataflow
  
negative.code: CA1704,IdentifiersShouldBeSpelledCorrectly,Text,#N/A,Identifiers should be spelled correctly,The name of an externally visible identifier contains one or more words that are not recognized by the Microsoft spelling checker library.,Yes,4050045,134475,0.033203335,198.9998864,Naming,High,Low,Yes,,See if StyleCop has implemented it,NamingService
  CA1705,LongAcronymnsShouldBePascalBased,Microsoft.ApiDesignGuidelines,#N/A,Long acronyms should be pascal-cased,"This rule assumes it has found an acronym when the name contains four uppercase letters in a row, or at the end of the name, three uppercase letters in a row. By convention, two-letter acronyms use all uppercase letters, and acronyms of three or more characters use Pascal casing. The following examples conform to this naming convention: 'DB', 'CR', 'Cpa', and 'Ecma'. The following examples violate the convention: 'Io', 'XML', and 'DoD', and for non-parameter names, 'xp' and 'cpl'. Naming conventions provide a common look for libraries that target the common language runtime. This reduces the learning curve required for new software libraries, and increases customer confidence that the library was developed by someone with expertise in developing managed code.",,2574,90,0.034965035,97.54340432,Naming,,Low,No,,Deprecated rule (replaced by 1709),
  CA1706,ShortAcronymsShouldBeUpperCase,Microsoft.ApiDesignGuidelines,#N/A,Short acronyms should be uppercase,"This rule splits the name into words based on the casing and checks any two-letter words against a list of common two-letter words, such as ""In"" or ""My"". If a match is not found, the word is assumed to be an acronym. For parameters, the first word is ignored due to the camel casing convention used for parameter names. By convention, two-letter acronyms use all uppercase letters, and acronyms of three or more characters use Pascal casing. The following examples conform to this naming convention: 'DB', 'CR', 'Cpa', and 'Ecma'. The following examples violate the convention: 'Io', 'XML', and 'DoD', and for non-parameter names, 'xp' and 'cpl'. 'ID' is special-cased to cause a violation of this rule. 'Id' is not an acronym but is an abbreviation for 'identification'. Naming conventions provide a common look for libraries that target the common language runtime. This reduces the learning curve required for new software libraries, and increases customer confidence that the library was developed by someone with expertise in developing managed code.",,470,2,0.004255319,627.9429966,Naming,,Low,No,,Deprecated rule (replaced by 1709),
  CA1707,IdentifiersShouldNotContainUnderscores,Microsoft.ApiDesignGuidelines,#N/A,Identifiers should not contain underscores,"By convention, identifier names do not contain the underscore (_) character. This rule checks namespaces, types, members, and parameters.",Yes,1216136,42995,0.035353776,172.1168937,Naming,High,Low,Yes,,See if StyleCop has implemented it,None
  CA1060,MovePInvokesToNativeMethodsClass,Microsoft.ApiDesignGuidelines,System.Runtime.InteropServices.Analyzers,Move pinvokes to native methods class,"Platform Invocation methods, such as those that are marked by using the System.Runtime.InteropServices.DllImportAttribute attribute, or methods that are defined by using the Declare keyword in Visual Basic, access unmanaged code. These methods should be of the NativeMethods, SafeNativeMethods, or UnsafeNativeMethods class.",Yes,377447,2739,0.007256648,768.5168157,Design,,High,Ported,,,
  CA1709,IdentifiersShouldBeCasedCorrectly,Microsoft.ApiDesignGuidelines,#N/A,Identifiers should be cased correctly,"By convention, parameter names use camel casing and namespace, type, and member names use Pascal casing.",Yes,3261791,137633,0.04219553,154.3636525,Naming,,Low,Yes,,See if StyleCop has implemented it,NamingService
  CA1710,IdentifiersShouldHaveCorrectSuffix,Microsoft.ApiDesignGuidelines,#N/A,Identifiers should have correct suffix,"By convention, the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, have a suffix that is associated with the base type or interface.",Yes,597568,3205,0.005363406,1076.999758,Naming,,High,Yes,,See if StyleCop has implemented it,None
  CA1711,IdentifiersShouldNotHaveIncorrectSuffix,Microsoft.ApiDesignGuidelines,#N/A,Identifiers should not have incorrect suffix,"By convention, only the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, should end with specific reserved suffixes. Other type names should not use these reserved suffixes.",Yes,684645,2065,0.003016162,1934.732318,Naming,,High,Yes,,See if StyleCop has implemented it,None
  CA1712,DoNotPrefixEnumValuesWithTypeName,Microsoft.ApiDesignGuidelines,#N/A,Do not prefix enum values with type name,Names of enumeration members are not prefixed by using the type name because development tools are expected to provide type information.,Yes,15010,57,0.003797468,1099.780249,Naming,,Low,Yes,,See if StyleCop has implemented it,
  CA1713,EventsShouldNotHaveBeforeOrAfterPrefix,Microsoft.ApiDesignGuidelines,#N/A,Events should not have before or after prefix,"The name of an event starts with """"Before"""" or """"After"""". To name related events that are raised in a specific sequence, use the present or past tense to indicate the relative position in the sequence of actions.",Yes,42823,58,0.001354412,3419.694965,Naming,,Low,Yes,,See if StyleCop has implemented it,
  CA1714,FlagsEnumsShouldHavePluralNames,Microsoft.ApiDesignGuidelines,#N/A,Flags enums should have plural names,"A public enumeration has the System.FlagsAttribute attribute, and its name does not end in """"s"""". Types that are marked by using FlagsAttribute have names that are plural because the attribute indicates that more than one value can be specified.",Yes,149797,409,0.002730362,1895.537507,Naming,,High,Yes,,See if StyleCop has implemented it,None
  CA1708,IdentifiersShouldDifferByMoreThanCase,Microsoft.ApiDesignGuidelines,Microsoft.AnalyzerPowerPack,Identifiers should differ by more than case,"Identifiers for namespaces, types, members, and parameters cannot differ only by case because languages that target the common language runtime are not required to be case-sensitive.",Yes,240275,455,0.001893664,2841.428034,Naming,,High,Ported,,,
  CA1716,IdentifiersShouldNotMatchKeywords,Microsoft.ApiDesignGuidelines,#N/A,Identifiers should not match keywords,A namespace name or a type name matches a reserved keyword in a programming language. Identifiers for namespaces and types should not match keywords that are defined by languages that target the common language runtime.,Yes,563948,2635,0.004672417,1230.891752,Naming,,High,Yes,,See if StyleCop has implemented it,Valid rule?
  CA1717,OnlyFlagsEnumsShouldHavePluralNames,Microsoft.ApiDesignGuidelines,#N/A,Only FlagsAttribute enums should have plural names,Naming conventions dictate that a plural name for an enumeration indicates that more than one value of the enumeration can be specified at the same time.,Yes,389307,875,0.002247584,2487.245589,Naming,,High,Yes,,See if StyleCop has implemented it,None
  CA1718,#N/A,Microsoft.ApiDesignGuidelines,#N/A,Avoid language specific type names in parameters,"Each concatenated word in the parameter name is checked against language-specific type names, in a case-insensitive manner",,4,0,0,,Naming,,Low,Yes,,See if StyleCop has implemented it,
  CA1719,ParameterNamesShouldNotMatchMemberNames,Microsoft.ApiDesignGuidelines,#N/A,Parameter names should not match member names,A parameter name should communicate the meaning of a parameter and a member name should communicate the meaning of a member. It would be a rare design where these were the same. Naming a parameter the same as its member name is unintuitive and makes the library difficult to use.,Yes,96386,394,0.004087731,1219.261851,Naming,,Low,Yes,,See if StyleCop has implemented it,None
  CA1715,IdentifiersShouldHaveCorrectPrefix,Microsoft.ApiDesignGuidelines,Microsoft.AnalyzerPowerPack,Identifiers should have correct prefix,"The name of an externally visible interface does not start with an uppercase """"I"""". The name of a generic type parameter on an externally visible type or method does not start with an uppercase """"T"""".",Yes,163866,1290,0.007872286,662.3856049,Naming,,High,Ported,,,
  CA1721,PropertyNamesShouldNotMatchGetMethods,Microsoft.ApiDesignGuidelines,#N/A,Property names should not match get methods,"The name of a public or protected member starts with """"Get"""" and otherwise matches the name of a public or protected property. """"Get"""" methods and properties should have names that clearly distinguish their function.",Yes,622332,1854,0.002979117,1944.878847,Naming,,High,Yes,,See if StyleCop has implemented it,None
  CA1722,IdentifiersShouldNotHaveIncorrectPrefix,Microsoft.ApiDesignGuidelines,#N/A,Identifiers should not have incorrect prefix,"By convention, only certain programming elements have names that begin with a specific prefix.",Yes,28805,234,0.00812359,548.952873,Naming,,Low,Yes,,See if StyleCop has implemented it,
  CA1724,TypeNamesShouldNotMatchNamespaces,Microsoft.ApiDesignGuidelines,#N/A,Type names should not match namespaces,Type names should not match the names of namespaces that are defined in the .NET Framework class library. Violating this rule can reduce the usability of the library.,Yes,633745,1999,0.003154266,1839.38686,Naming,,High,Yes,,See if StyleCop has implemented it,Hardcoded table
  CA1725,ParameterNamesShouldMatchBaseDeclaration,Microsoft.ApiDesignGuidelines,#N/A,Parameter names should match base declaration,Consistent naming of parameters in an override hierarchy increases the usability of the method overrides. A parameter name in a derived method that differs from the name in the base declaration can cause confusion about whether the method is an override of the base method or a new overload of the method.,Yes,829781,4723,0.005691863,1039.899098,Naming,,High,Yes,,See if StyleCop has implemented it,None
  CA1726,UsePreferredTerms,Microsoft.ApiDesignGuidelines,#N/A,Use preferred terms,"The name of an externally visible identifier includes a term for which an alternative, preferred term exists. Alternatively, the name includes the term """"Flag"""" or """"Flags"""".",Yes,1027505,7215,0.007021864,856.1521914,Naming,,High,Yes,,See if StyleCop has implemented it,NamingService
  CA1800,DoNotCastUnnecessarily,System.Runtime,#N/A,Do not cast unnecessarily,"Duplicate casts decrease performance, especially when the casts are performed in compact iteration statements.",Yes,1161244,5060,0.004357396,1391.868776,Performance,,High,No,,,RemoveUnnecessaryCast IDE CodeFix
  CA1801,ReviewUnusedParameters,Microsoft.Maintainability,#N/A,Review unused parameters,A method signature includes a parameter that is not used in the method body.,Yes,2443403,26581,0.01087868,587.20313,Performance,High,Low,Yes,,Don't fire if the parameter comes from an interface you're implementing or a virtual method you're overriding.,"None, can be based on: https://github.com/dotnet/roslyn/blob/master/src/Samples/CSharp/Analyzers/CSharpAnalyzers/CSharpAnalyzers/StatefulAnalyzers/CodeBlockStartedAnalyzer.cs"
  CA1802,UseLiteralsWhereAppropriate,Microsoft.QualityGuidelines,#N/A,Use literals where appropriate,"A field is declared static and read-only (Shared and ReadOnly in Visual Basic), and is initialized by using a value that is computable at compile time. Because the value that is assigned to the targeted field is computable at compile time, change the declaration to a const (Const in Visual Basic) field so that the value is computed at compile time instead of at run?time.",Yes,156024,573,0.003672512,1414.070674,Performance,,High,Yes,,Does it fire on publics? That has versioning implications. Consider only firing on symbols not visible outside assembly.,None
  CA1804,RemoveUnusedLocals,Microsoft.Maintainability,#N/A,Remove unused locals,Unused local variables and unnecessary assignments increase the size of an assembly and decrease performance.,Yes,2660659,16292,0.006123295,1049.269911,Performance,,High,Yes,,"See if the compiler warns of this. At the least, it should have a fixer.",None
  CA1805,DoNotInitializeUnnecessarily,Microsoft.QualityGuidelines,#N/A,Do not initialize unnecessarily,"The common language runtime initializes all fields to their default values before running the constructor. In most cases, initializing a field to its default value in a constructor is redundant, which degrades performance and adds to maintenance costs. One case where it is not redundant occurs when the constructor calls another constructor of the same class or a base class constructor and that constructor initializes the field to a non-default value. In this case, changing the value of the field back to its default value can be appropriate.",,900111,3408,0.0037862,1572.631276,Performance,,High,Yes,,,
  CA1806,DoNotIgnoreMethodResults,Microsoft.Maintainability,#N/A,Do not ignore method results,A new object is created but never used; or a method that creates and returns a new string is called and the new string is never used; or a COM or P/Invoke method returns an HRESULT or error code that is never used.,Yes,845078,3707,0.004386577,1351.143806,Performance,,High,Yes,,"Consider having a whitelist, like immutable types (including string), and also look for the Pure attribute",None
  CA1809,AvoidExcessiveLocals,Microsoft.Maintainability,#N/A,Avoid excessive locals,"A common performance optimization is to store a value in a processor register instead of memory, which is referred to as """"enregistering the value"""". To increase the chance that all local variables are enregistered, limit the number of local variables to?64.",Yes,136521,362,0.002651607,1936.636922,Performance,,High,No,,"This was created at a time when after a certain number of locals, the JITTer would stop trying to allocate them to registers. This is hard to do in source analysis because it's hard to know how many locals the compiler allocates.",None
  CA1720,IdentifiersShouldNotContainTypeNames,Microsoft.ApiDesignGuidelines,#N/A,Avoid type names in parameters,"The name of a parameter in an externally visible member contains a data type name, or the name of an externally visible member contains a language-specific data type name.",Yes,904982,5153,0.005694036,1046.11914,Naming,,High,Ported,,,None
  CA1811,AvoidUncalledPrivateCode,Microsoft.Maintainability,#N/A,Avoid uncalled private code,A private or internal (assembly-level) member does not have callers in the assembly; it is not invoked by the common language runtime; and it is not invoked by a delegate.,Yes,2515500,32368,0.012867422,497.4286481,Performance,,Low,Yes,,Implementation: Create a dictionary at compilation start; add to it each time you see a function call.,IOperation
  CA1812,AvoidUninstantiatedInternalClasses,Microsoft.Maintainability,#N/A,Avoid uninstantiated internal classes,An instance of an assembly-level type is not created by code in the assembly.,Yes,830636,3549,0.00427263,1385.42566,Performance,,High,Yes,,"Do we need additional APIs to make this efficient, for example, a RegisterSymbolReferenceAction API?",FxCopSDKUtilities
  CA2217,DoNotMarkEnumsWithFlags,Microsoft.ApiDesignGuidelines,System.Runtime.Analyzers,Do not mark enums with FlagsAttribute,"An externally visible enumeration is marked by using FlagsAttribute, and it has one or more values that are not powers of two or a combination of the other defined values on the enumeration.",Yes,33479,117,0.003494728,1294.742374,Usage,,High,Ported,,,None
  CA1814,PreferJaggedArraysOverMultidimensional,Microsoft.QualityGuidelines,#N/A,Prefer jagged arrays over multidimensional,"A jagged array is an array whose elements are arrays. The arrays that make up the elements can be of different sizes, leading to less wasted space for some sets of data.",Yes,163220,1424,0.008724421,597.492184,Performance,,High,Yes,,,None
  CA1815,OverrideEqualsAndOperatorEqualsOnValueTypes,Microsoft.ApiDesignGuidelines,#N/A,Override equals and operator equals on value types,"For value types, the inherited implementation of Equals uses the Reflection library and compares the contents of all fields. Reflection is computationally expensive, and comparing every field for equality might be unnecessary. If you expect users to compare or sort instances, or to use instances as hash table keys, your value type should implement Equals.",Yes,399294,1633,0.004089718,1369.603552,Performance,,High,Yes,,,None
  CA1816,CallGCSuppressFinalizeCorrectly,System.Runtime,#N/A,Dispose methods should call SuppressFinalize,A method that is an implementation of Dispose does not call GC.SuppressFinalize; or a method that is not an implementation of Dispose calls GC.SuppressFinalize; or a method calls GC.SuppressFinalize and passes something other than this (Me in Visual?Basic).,Yes,443318,1136,0.002562495,2203.600847,Performance,,High,Yes,,,None
  CA1819,PropertiesShouldNotReturnArrays,Microsoft.ApiDesignGuidelines,#N/A,Properties should not return arrays,"Arrays that are returned by properties are not write-protected, even when the property is read-only. To keep the array tamper-proof, the property must return a copy of the array. Typically, users will not understand the adverse performance implications of calling such a property.",Yes,866343,7145,0.008247311,719.9546614,Performance,,High,Yes,,,None
  CA2227,CollectionPropertiesShouldBeReadOnly,Microsoft.ApiDesignGuidelines,#N/A,Collection properties should be read only,A writable collection property allows a user to replace the collection with a different collection. A read-only property stops the collection from being replaced but still allows the individual members to be set.,Yes,1479039,18904,0.012781272,482.7359551,Usage,,High,Ported,,,None
  CA1821,RemoveEmptyFinalizers,Microsoft.QualityGuidelines,Microsoft.AnalyzerPowerPack,Remove empty finalizers,"Whenever you can, avoid finalizers because of the additional performance overhead that is involved in tracking object lifetime. An empty finalizer incurs added overhead and delivers no benefit.",Yes,39675,3102,0.078185255,58.81565423,Performance,,Low,Yes,,Sri thinks we've already implemented this.,
  CA1822,MarkMembersAsStatic,Microsoft.QualityGuidelines,#N/A,Mark members as static,"Members that do not access instance data or call instance methods can be marked as static (Shared in Visual Basic). After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.",Yes,3382541,37372,0.011048499,590.9620138,Performance,High,Low,Yes,,"Doesn't depend on IOperation, but would be language-agnostic if it did use IOperation.",IOperation
  CA1823,AvoidUnusedPrivateFields,Microsoft.Maintainability,#N/A,Avoid unused private fields,Private fields were detected that do not appear to be accessed in the assembly.,Yes,2037563,18054,0.008860585,712.0422748,Performance,,High,Yes,,,None
  CA1824,MarkAssembliesWithNeutralResourcesLanguage,System.Resources.ResourceManager,#N/A,Mark assemblies with NeutralResourcesLanguageAttribute,The NeutralResourcesLanguage attribute informs the ResourceManager of the language that was used to display the resources of a neutral culture for an assembly. This improves lookup performance for the first resource that you load and can reduce your working set.,Yes,807994,798,0.000987631,5981.39139,Performance,,High,Yes,,,None
  CA1900,ValueTypeFieldsShouldBePortable,Microsoft.QualityGuidelines,#N/A,Value type fields should be portable,This rule checks that structures that are declared by using explicit layout will align correctly when marshaled to unmanaged code on 64-bit operating systems.,Yes,21717,139,0.006400516,677.5703737,Portability,,Low,Yes,,,
  RS0008,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,Implement IEquatable when overriding Object.Equals,#N/A,,,,,,Performance,,,Ported,,,
  CA1903,UseOnlyApiFromTargetedFramework,System.Runtime,#N/A,Use only api from targeted framework,A member or type is using a member or type that was introduced in a service pack that was not included together with the targeted framework of the project.,Yes,114762,732,0.006378418,793.2685116,Portability,,High,No,,This was invented before we learned to ship new reference assemblies with each service pack.,FrameworkCompatibilityService
  CA2000,DisposeObjectsBeforeLosingScope,Microsoft.QualityGuidelines,#N/A,Dispose Objects Before Losing Scope,"Because an exceptional event might occur that will prevent the finalizer of an object from running, the object should be explicitly disposed before all references to it are out of scope.",Yes,2950496,21737,0.007367236,878.1984362,Reliability,,High,Yes,,,Dataflow
  CA2001,AvoidCallingProblematicMethods,ApiReview,#N/A,Avoid calling problematic methods,A member calls a potentially dangerous or problematic method.,Yes,279199,1198,0.004290846,1269.193408,Reliability,,Low,Yes,,,None
  RS0011,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,CancellationToken parameters must come last,#N/A,,,,,,ApiDesign,,,Ported,,,
  CA2003,DoNotTreatFibersAsThreads,System.Runtime.InteropServices,#N/A,Do not treat fibers as threads,A managed thread is being treated as a Win32 thread.,Yes,34,0,0,,Reliability,,Low,No,,,
  