anchor.diff:  CA1300,SpecifyMessageBoxOptions,Desktop,#N/A,Specify MessageBoxOptions,"To correctly display a message box for cultures that use a right-to-left reading order, the RightAlign and RtlReading members of the MessageBoxOptions enumeration must be passed to the Show method.",Yes,283590,2427,0.00855813,637.1358121,Globalization,,Low,Yes,,,None
   CA1301,AvoidDuplicateAccelerators,Desktop,#N/A,Avoid duplicate accelerators,"An access key, also known as an accelerator, enables keyboard access to a control by using the ALT key. When multiple controls have duplicate access keys, the behavior of the access key is not well defined.",Yes,2707,16,0.005910602,580.7341068,Globalization,,Low,Yes,,,
   CA1302,DoNotHardcodeLocaleSpecificStrings,Desktop,#N/A,Do not hardcode locale specific strings,"The System.Environment.SpecialFolder enumeration contains members that refer to special system folders. The locations of these folders can have different values on different operating systems; the user can change some of the locations; and the locations are localized. The Environment.GetFolderPath method returns the locations that are associated with the Environment.SpecialFolder enumeration, localized and appropriate for the currently running computer.",Yes,13519,71,0.005251868,786.5667551,Globalization,,Low,No,,,
  -CA1303,DoNotPassLiteralsAsLocalizedParameters,System.Runtime,#N/A,Do not pass literals as localized parameters,"An externally visible method passes a string literal as a parameter to a constructor or method in the .NET Framework class library, and that string should be localizable.",Yes,1370581,20484,0.014945487,410.6192633,Globalization,,Low,Yes,,,Dataflow
  +CA1303,DoNotPassLiteralsAsLocalizedParameters,Microsoft.QualityGuidelines,#N/A,Do not pass literals as localized parameters,"An externally visible method passes a string literal as a parameter to a constructor or method in the .NET Framework class library, and that string should be localizable.",Yes,1370581,20484,0.014945487,410.6192633,Globalization,,Low,Yes,,,Dataflow
   CA1304,SpecifyCultureInfo,System.Runtime,#N/A,Specify CultureInfo,"A method or constructor calls a member that has an overload that accepts a System.Globalization.CultureInfo parameter, and the method or constructor does not call the overload that takes the CultureInfo parameter. When a CultureInfo or System.IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales.",Yes,1301330,3995,0.003069936,1991.698576,Globalization,,High,Yes,,,None
   CA1305,SpecifyIFormatProvider,System.Runtime,#N/A,Specify IFormatProvider,"A method or constructor calls one or more members that have overloads that accept a System.IFormatProvider parameter, and the method or constructor does not call the overload that takes the IFormatProvider parameter. When a System.Globalization.CultureInfo or IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales.",Yes,3114669,26486,0.008503632,763.6044986,Globalization,,High,Yes,,,None
   CA1306,SetLocaleForDataTypes,Desktop,#N/A,Set locale for data types,"The locale determines culture-specific presentation elements for data, such as formatting that is used for numeric values, currency symbols, and sort order. When you create a DataTable or DataSet, you should explicitly set the locale.",Yes,486816,1204,0.002473214,2299.584887,Globalization,,Low,Yes,,,Dataflow
  
positive.code: RS0024,#N/A,Roslyn.Diagnostics,Roslyn.Diagnostics.Analyzers,The contents of the public API files are invalid,#N/A,,,,,,ApiDesign,,,Ported,,,
  RS0012,#N/A,System.Collections.Immutable,Roslyn.Diagnostics.Analyzers,Do not call ToImmutableArray on an ImmutableArray value,#N/A,,,,,,Reliability,,,Ported,,,
  CA1309,UseOrdinalStringComparison,System.Runtime,System.Runtime.Analyzers,Use ordinal stringcomparison,"A string comparison operation that is nonlinguistic does not set the StringComparison parameter to either Ordinal or OrdinalIgnoreCase. By explicitly setting the parameter to either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase, your code often gains speed, becomes more correct, and becomes more reliable.",Yes,450803,879,0.001949854,2899.697623,Globalization,,High,Ported,,,
  CA1810,InitializeReferenceTypeStaticFieldsInline,System.Runtime,#N/A,Initialize reference type static fields inline,"When a type declares an explicit static constructor, the just-in-time (JIT) compiler adds a check to each static method and instance constructor of the type to make sure that the static constructor was previously called. Static constructor checks can decrease performance.",Yes,755408,2731,0.003615265,1625.933867,Performance,,High,Ported,,,None
  CA1813,AvoidUnsealedAttributes,System.Runtime,System.Runtime.Analyzers,Avoid unsealed attributes,"The .NET Framework class library provides methods for retrieving custom attributes. By default, these methods search the attribute inheritance hierarchy. Sealing the attribute eliminates the search through the inheritance hierarchy and can improve performance.",Yes,219135,401,0.001829922,2918.545808,Performance,,High,Ported,,,
  CA1820,TestForEmptyStringsUsingStringLength,System.Runtime,System.Runtime.Analyzers,Test for empty strings using string length,Comparing strings by using the String.Length property or the String.IsNullOrEmpty method is significantly faster than using Equals.,Yes,1121246,2134,0.00190324,3178.633057,Performance,,High,Ported,,,
  CA2002,DoNotLockOnObjectsWithWeakIdentity,System.Runtime,System.Runtime.Analyzers,Do not lock on objects with weak identity,An object is said to have a weak identity when it can be directly accessed across application domain boundaries. A thread that tries to acquire a lock on an object that has a weak identity can be blocked by a second thread in a different application domain that has a lock on the same object.,Yes,123953,440,0.003549733,1434.828387,Reliability,,High,Ported,,,
  CA2153,DoNotCatchCorruptedStateExceptionsInGeneralHandlers,System.Runtime,Desktop.Analyzers,Do not catch corrupted state exceptions in general handlers.,Do not author general catch handlers in code that receives corrupted state exceptions.,No,,,,,Security,,,Ported,,,
  CA2200,RethrowToPreserveStackDetails,System.Runtime,Microsoft.AnalyzerPowerPack,Rethrow to preserve stack details,"An exception is rethrown and the exception is explicitly specified in the throw statement. If an exception is rethrown by specifying the exception in the throw statement, the list of method calls between the original method that threw the exception and the current method is lost.",Yes,713166,2048,0.002871702,2038.230737,Usage,,High,Ported,,,None
  CA2201,DoNotRaiseReservedExceptionTypes,System.Runtime,#N/A,Do not raise reserved exception types,This makes the original error difficult to detect and debug.,Yes,1439723,9215,0.006400537,962.150389,Usage,,High,Ported,,,None
  CA2207,InitializeValueTypeStaticFieldsInline,System.Runtime,#N/A,Initialize value type static fields inline,"A value type declares an explicit static constructor. To fix a violation of this rule, initialize all static data when it is declared and remove the static constructor.",Yes,13270,20,0.001507159,2735.524857,Usage,,High,Ported,,,None
  CA2213,DisposableFieldsShouldBeDisposed,System.Runtime,System.Runtime.Analyzers,Disposable fields should be disposed,A type that implements System.IDisposable declares fields that are of types that also implement IDisposable. The Dispose method of the field is not called by the Dispose method of the declaring type.,Yes,347843,920,0.002644871,2095.142804,Usage,,High,Ported,,,Dataflow
  CA2214,DoNotCallOverridableMethodsInConstructors,System.Runtime,Microsoft.AnalyzerPowerPack,Do not call overridable methods in constructors,"When a constructor calls a virtual method, the constructor for the instance that invokes the method may not have executed.",Yes,681532,2824,0.004143606,1407.828453,Usage,,High,Ported,,,None
  RS0007,#N/A,System.Runtime,Roslyn.Diagnostics.Analyzers,Avoid zero-length array allocations.,#N/A,,,,,,Performance,,,Ported,,,
  RS0014,#N/A,System.Runtime,Roslyn.Diagnostics.Analyzers,Do not use Enumerable methods on indexable collections. Instead use the collection directly,This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.,,,,,,Performance,,,Ported,,,
  CA1401,PInvokesShouldNotBeVisible,System.Runtime.InteropServices,System.Runtime.InteropServices.Analyzers,PInvokes should not be visible,A public or protected method in a public type has the System.Runtime.InteropServices.DllImportAttribute attribute (also implemented by the Declare keyword in Visual Basic). Such methods should not be exposed.,Yes,128953,940,0.007289478,701.0696455,Interoperability,,High,Ported,,,
  
negative.code: CA2241,ProvideCorrectArgumentsToFormattingMethods,System.Runtime,#N/A,Provide correct arguments to formatting methods,"The format argument that is passed to System.String.Format does not contain a format item that corresponds to each object argument, or vice versa.",Yes,275305,236,0.000857231,6345.796697,Usage,,High,Yes,,,Dataflow
  CA2242,TestForNaNCorrectly,System.Runtime,#N/A,Test for NaN correctly,This expression tests a value against Single.Nan or Double.Nan. Use Single.IsNan(Single) or Double.IsNan(Double) to test the value.,Yes,15800,4,0.000253165,16584.69549,Usage,,High,Yes,,,IOperation
  CA2243,AttributeStringLiteralsShouldParseCorrectly,System.Runtime,#N/A,Attribute string literals should parse correctly,"The string literal parameter of an attribute does not parse correctly for a URL, a GUID, or a version.",Yes,63488,553,0.008710307,551.3802662,Usage,,High,Yes,,,WordParser
  CA3050,DoNotUseXslTransform,System.Xml,#N/A,Do not use XslTransform,"Do not use obsolete and unsafe System.Xml.Xsl.XslTransform API. This API allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3053,UseXmlSecureResolver,System.Xml,#N/A,Use XmlSecureResolver,"Review code to ensure that external resource resolution is explicitly disabled or a XmlSecureResolver is used when processing untrusted input (the resolver used internally on some overloaded methods is not safe to use on untrusted input). Using default resolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3054,DoNotAllowDtdOnXmlTextReader,System.Xml,#N/A,Do not allow Dtd on XmlTextReader,"Prohibit DTD processing when using XmlTextReader on untrusted sources. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3055,DoNotAllowDtdOnXmlReader,System.Xml,#N/A,Do not allow Dtd on XmlReader,"Prohibit DTD processing when using XmlReader on untrusted sources. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3056,UseXmlReaderForLoad,System.Xml,#N/A,Use XmlReader for Load,"Do not use unsafe overloads of System.Xml.XmlDocument/XmlDataDocument Load. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3057,DoNotUseLoadXml,System.Xml,#N/A,Do not use LoadXml,"Do not use unsafe overloads of System.Xml.XmlDocument/XmlDataDocument LoadXml API. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3058,DoNotUseSetInnerXml,System.Xml,#N/A,Do not use SetInnerXml,"Do not use the unsafe setter of InnerXml property of System.Xml.XmlDocument/XmlDataDocument. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3059,UseXmlReaderForXPathDocument,System.Xml,#N/A,Use XmlReader for XPathDocument,"Do not use unsafe overloads of the constructor for System.Xml.XPath.Xpath.XPathDocument. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3060,UseXmlReaderForSchemaRead,System.Xml,#N/A,Use XmlReader for Schema Read,"Do not use unsafe overloads of System.Xml.Schema.XmlSchema.Read. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3061,DoNotAddStringsToXmlSchema,System.Xml,#N/A,Do not add strings to Xml schema,"Do not use unsafe overloads of System.Xml.Schema.XmlSchemaCollection.Add. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3062,UseXmlReaderForValidatingReader,System.Xml,#N/A,Use XmlReader for ValidatingReader,"Configure System.Xml.XmlValidatingReader to validate the parsed XML. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3063,UseXmlReaderForDataSetReadXml,Desktop,#N/A,Use XmlReader for DataSet ReadXml,"Do not use unsafe overloads of System.Data.DataSet.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
  CA3064,UseXmlReaderForDataSetReadXmlSchema,Desktop,#N/A,Use XmlReader for DataSet ReadXmlSchema,"Do not use unsafe overloads of System.Data.DataSet.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
  CA3065,ReviewDataViewCollectionString,Desktop,#N/A,Review DataView CollectionString,"Review code to insure that usage of System.Data.DataViewManager.DataViewSettingCollectionString input is sanitized to not contain DTD. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
  CA3066,ReviewWebControlForSet_Data,System.Web,#N/A,Review WebControl for set_Data,"Review code to insure that System.Web.UI.WebControls.XmlDataSource::Data is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,@michaelcfanning to review,
  CA3067,ReviewWebControlForSet_DocumentContent,System.Web,#N/A,Review WebControl for set_DocumentContent,"Review code to insure that System.Web.UI.WebControls.Xml::DocumentContent is set from a trusted source. This pattern internally enables DTD processing in XML and uses UrlResolver for resolving external XML entities, which, on untrusted input, may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,@michaelcfanning to review,
  CA3068,TextReaderImplNeedsSettingsAndResolver,System.Xml,#N/A,TextReaderImpl needs settings and resolver,"Do not use unsafe overloads of the constructor for the System.Xml.XmlTextReaderImpl. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3069,ReviewDtdProcessingAssignment,System.Xml,#N/A,Review DtdProcessing assignment,"Review all code that enables DtdProcessing to insure that it is necessary and properly documented. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3070,UseXmlReaderForDeserialize,System.Xml,#N/A,Use XmlReader for Deserialize,"Do not use unsafe overloads of System.Xml.Serialization.XmlSerializer.Deserialize. This API internally enables DTD processing on the XML reader instance used but doesn't allow external entity resolution, enabling the attacker to DoS the machine processing the XML with a single especially crafted XML input.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3071,UseXmlReaderForDataTableReadXml,Desktop,#N/A,Use XmlReader for DataTable ReadXml,"Do not use unsafe overloads of System.Data.DataTable.ReadXml. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
  CA3072,UseXmlReaderForDataTableReadXmlSchema,Desktop,#N/A,Use XmlReader for DataTable ReadXmlSchema,"Checks for usage of an unsafe overload of  System.Data.DataTable.ReadXmlSchema. This API internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,High,Yes,,,
  CA3073,ReviewTrustedXsltUse,System.Xml,#N/A,Review Trusted Xslt use,"Review code to insure that System.Xml.Xsl.XsltSettings::TrustedXslt is set from a trusted source. This pattern allows processing script within XSL, which, on untrusted XSL input, may lead to malicious code execution.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA3074,ReviewClassesDerivedFromXmlTextReader,System.Xml,#N/A,Review classes derived from XmlTextReader,"Review code to insure that  DTD prosessing is disabled on all instances of classes derived from System.Xml.XmlTextReader. Enabling DTD processing on the XML reader and using UrlResolver for resolving external XML entities may lead to information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.",No,,,,,,,,No,,These will be consolidated into two or three new rules,
  CA5122,PInvokesShouldNotBeSafeCriticalFxCopRule,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,,Low,No,,,
  CA5350,DoNotUseWeakCryptographicAlgorithms,System.Security.Cryptography.Algorithms,#N/A,Do Not Use Weak Cryptographic Algorithms,"Cryptographic algorithms degrade over time as attacks become for advances to attacker get access to more computation. Depending on the type and application of this cryptographic algorithm, further degradation of the cryptographic strength of it may allow attackers to read enciphered messages, tamper with enciphered? messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA-2 512, SHA-2 384, or SHA-2 256.",No,,,,,,,,Ported,,,
  CA5351,DoNotUseBrokenCryptographicAlgorithms,System.Security.Cryptography.Algorithms,#N/A,Do Not Use Broken Cryptographic Algorithms,"An attack making it computationally feasible to break this algorithm exists. This allows attackers to break the cryptographic guarantees it is designed to provide. Depending on the type and application of this cryptographic algorithm, this may allow attackers to read enciphered messages, tamper with enciphered? messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA512, SHA384, or SHA256. Replace digital signature uses with RSA with a key length greater than or equal to 2048-bits, or ECDSA with a key length greater than or equal to 256 bits.",No,,,,,,,,Ported,,,
  CA5352,RC2CannotBeUsed,System.Security.Cryptography.Algorithms,#N/A,Do not use RC2,RC2 is banned by SDL,No,,,,,,,,No,,merged into CA5351,
  