Bugs 1026593, 1026595: Set DtdProcessing = DtdProcessing.Prohibit, XmlResolver...

Bugs 1026593, 1026595: Set DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null for all XML processing. Also fixes minor typos and redundant code. (changeset 1346103)

Src/Compilers/CSharp/Portable/Compiler/DocumentationCommentCompiler.DocumentationCommentWalker.cs

 // Copyright (c) Microsoft Open Technologies, Inc.  All Rights Reserved.  Licensed under the Apache License, Version 2.0.  See License.txt in the project root for license information.
 
 using System.Collections.Generic;
-using System.Diagnostics;
+using System.Globalization;
 using System.IO;
 using Microsoft.CodeAnalysis.Collections;
 using Microsoft.CodeAnalysis.CSharp.Symbols;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
-using Microsoft.CodeAnalysis.Text;
 using Roslyn.Utilities;
-using System.Globalization;
 
 namespace Microsoft.CodeAnalysis.CSharp
 {
@@ -84,7 +82,7 @@ private class DocumentationCommentWalker : CSharpSyntaxWalker
             public override void DefaultVisit(SyntaxNode node)
             {
                 SyntaxKind nodeKind = node.CSharpKind();
-                bool diagnose = ((SyntaxTree)node.SyntaxTree).ReportDocumentationCommentDiagnostics();
+                bool diagnose = node.SyntaxTree.ReportDocumentationCommentDiagnostics();
 
                 if (nodeKind == SyntaxKind.XmlCrefAttribute)
                 {
@@ -103,7 +101,7 @@ public override void DefaultVisit(SyntaxNode node)
                     }
                     crefDiagnostics.Free();
 
-                    if ((object)writer != null)
+                    if (writer != null)
                     {
                         Visit(crefAttr.Name);
                         VisitToken(crefAttr.EqualsToken);
@@ -124,7 +122,7 @@ public override void DefaultVisit(SyntaxNode node)
                     // Don't descend - we've already written out everything necessary.
                     return;
                 }
-                else if (nodeKind == SyntaxKind.XmlNameAttribute && diagnose)
+                else if (diagnose && nodeKind == SyntaxKind.XmlNameAttribute)
                 {
                     XmlNameAttributeSyntax nameAttr = (XmlNameAttributeSyntax)node;
 
@@ -132,14 +130,14 @@ public override void DefaultVisit(SyntaxNode node)
                     Binder binder = factory.GetBinder(nameAttr, nameAttr.Identifier.SpanStart);
 
                     // Do this for diagnostics, even if we aren't writing.
-                    DocumentationCommentCompiler.BindName(nameAttr, binder, memberSymbol, ref documentedParameters, ref documentedTypeParameters, diagnostics);
+                    BindName(nameAttr, binder, memberSymbol, ref documentedParameters, ref documentedTypeParameters, diagnostics);
 
                     // Do descend - we still need to write out the tokens of the attribute.
                 }
 
                 // NOTE: if we're recording any include element nodes (i.e. if includeElementsNodes is non-null),
                 // then we want to record all of them, because we won't be able to distinguish in the XML DOM.
-                if ((object)includeElementNodes != null)
+                if (includeElementNodes != null)
                 {
                     XmlNameSyntax nameSyntax = null;
                     if (nodeKind == SyntaxKind.XmlEmptyElement)
@@ -151,7 +149,7 @@ public override void DefaultVisit(SyntaxNode node)
                         nameSyntax = ((XmlElementStartTagSyntax)node).Name;
                     }
 
-                    if ((object)nameSyntax != null && (object)nameSyntax.Prefix == null &&
+                    if (nameSyntax != null && nameSyntax.Prefix == null &&
                         DocumentationCommentXmlNames.ElementEquals(nameSyntax.LocalName.ValueText, DocumentationCommentXmlNames.IncludeElementName))
                     {
                         includeElementNodes.Add((CSharpSyntaxNode)node);
@@ -163,7 +161,7 @@ public override void DefaultVisit(SyntaxNode node)
 
             public override void VisitToken(SyntaxToken token)
             {
-                if ((object)writer != null)
+                if (writer != null)
                 {
                     token.WriteTo(writer);
                 }

Src/Compilers/CSharp/Portable/Compiler/DocumentationCommentCompiler.cs

@@ -6,19 +6,16 @@
 using System.Diagnostics;
 using System.Globalization;
 using System.IO;
-using System.Linq; //In asserts.
 using System.Reflection;
 using System.Resources;
 using System.Text;
 using System.Threading;
 using System.Xml;
-using System.Xml.Linq;
 using Microsoft.CodeAnalysis.Collections;
 using Microsoft.CodeAnalysis.CSharp.Symbols;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Microsoft.CodeAnalysis.Instrumentation;
 using Microsoft.CodeAnalysis.Text;
-using Roslyn.Utilities;
 
 namespace Microsoft.CodeAnalysis.CSharp
 {
@@ -346,7 +343,7 @@ public override void DefaultVisit(Symbol symbol)
                         if (!documentedParameters.Contains(parameter))
                         {
                             Location location = parameter.Locations[0];
-                            Debug.Assert(((SyntaxTree)location.SourceTree).ReportDocumentationCommentDiagnostics()); //Should be the same tree as for the symbol.
+                            Debug.Assert(location.SourceTree.ReportDocumentationCommentDiagnostics()); //Should be the same tree as for the symbol.
                                         
                             // NOTE: parameter name, since the parameter would be displayed as just its type.
                             diagnostics.Add(ErrorCode.WRN_MissingParamTag, location, parameter.Name, symbol);
@@ -361,7 +358,7 @@ public override void DefaultVisit(Symbol symbol)
                         if (!documentedTypeParameters.Contains(typeParameter))
                         {
                             Location location = typeParameter.Locations[0];
-                            Debug.Assert(((SyntaxTree)location.SourceTree).ReportDocumentationCommentDiagnostics()); //Should be the same tree as for the symbol.
+                            Debug.Assert(location.SourceTree.ReportDocumentationCommentDiagnostics()); //Should be the same tree as for the symbol.
 
                             diagnostics.Add(ErrorCode.WRN_MissingTypeParamTag, location, typeParameter, symbol);
                         }
@@ -497,7 +494,7 @@ private static Location GetLocationInTreeReportingDocumentationCommentDiagnostic
         {
             foreach (Location location in symbol.Locations)
             {
-                if (((SyntaxTree)location.SourceTree).ReportDocumentationCommentDiagnostics())
+                if (location.SourceTree.ReportDocumentationCommentDiagnostics())
                 {
                     return location;
                 }
@@ -1141,7 +1138,7 @@ private void Write(string indentedAndWrappedString)
 
         private void WriteLine(string message)
         {
-            if (temporaryStringBuilders != null && temporaryStringBuilders.Count > 0)
+            if (temporaryStringBuilders?.Count > 0)
             {
                 StringBuilder builder = temporaryStringBuilders.Peek().Pooled.Builder;
                 builder.Append(MakeIndent(indentDepth));
@@ -1156,7 +1153,7 @@ private void WriteLine(string message)
 
         private void WriteSubStringLine(string message, int start, int length)
         {
-            if (temporaryStringBuilders != null && temporaryStringBuilders.Count > 0)
+            if (temporaryStringBuilders?.Count > 0)
             {
                 StringBuilder builder = temporaryStringBuilders.Peek().Pooled.Builder;
                 builder.Append(MakeIndent(indentDepth));

Src/Compilers/CSharp/Portable/Compiler/UnprocessedDocumentationCommentFinder.cs

 // Copyright (c) Microsoft Open Technologies, Inc.  All Rights Reserved.  Licensed under the Apache License, Version 2.0.  See License.txt in the project root for license information.
 
 using System.Threading;
-using Microsoft.CodeAnalysis.CSharp.Symbols;
 using Microsoft.CodeAnalysis.CSharp.Syntax;
 using Microsoft.CodeAnalysis.Text;
 

Src/Compilers/CSharp/Portable/Parser/DocumentationCommentParser.cs

@@ -3,9 +3,6 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
-using Microsoft.CodeAnalysis.CSharp.Symbols;
-using Microsoft.CodeAnalysis.CSharp.Syntax;
-using Microsoft.CodeAnalysis.Text;
 using Roslyn.Utilities;
 
 namespace Microsoft.CodeAnalysis.CSharp.Syntax.InternalSyntax
@@ -447,7 +444,7 @@ private XmlAttributeSyntax ParseXmlAttribute(XmlNameSyntax elementName)
             SyntaxToken startQuote;
             SyntaxToken endQuote;
             string attrNameText = attrName.LocalName.ValueText;
-            bool hasNoPrefix = (object)attrName.Prefix == null;
+            bool hasNoPrefix = attrName.Prefix == null;
             if (hasNoPrefix && DocumentationCommentXmlNames.AttributeEquals(attrNameText, DocumentationCommentXmlNames.CrefAttributeName) &&
                 !IsVerbatimCref())
             {
@@ -479,7 +476,7 @@ private XmlAttributeSyntax ParseXmlAttribute(XmlNameSyntax elementName)
 
         private static bool XmlElementSupportsNameAttribute(XmlNameSyntax elementName)
         {
-            if ((object)elementName.Prefix != null)
+            if (elementName.Prefix != null)
             {
                 return false;
             }
@@ -1358,8 +1355,6 @@ private TypeSyntax ParseCrefTypeHelper(bool typeArgumentsMustBeIdentifiers, bool
         /// Once the name part of a type (including type parameter/argument lists) is parsed,
         /// we need to consume ?, *, and rank specifiers.
         /// </summary>
-        /// <param name="type"></param>
-        /// <returns></returns>
         private TypeSyntax ParseCrefTypeSuffix(TypeSyntax type)
         {
             if (CurrentToken.Kind == SyntaxKind.QuestionToken)

Src/Compilers/CSharp/Test/Symbol/Compilation/CompilationAPITests.cs

@@ -693,7 +693,7 @@ public class C3 {
         [WorkItem(718500, "DevDiv")]
         [WorkItem(716762, "DevDiv")]
         [Fact]
-        public void MissedModuleB_NoErrorForUnmagagedModules()
+        public void MissedModuleB_NoErrorForUnmanagedModules()
         {
             var netModule1 = CreateCompilationWithMscorlib(
                 options: TestOptions.ReleaseModule,

Src/Compilers/Core/Desktop/AssemblyPortabilityPolicy.cs

@@ -47,13 +47,19 @@ private static bool ReadToChild(XmlReader reader, int depth, string elementName,
             return reader.ReadToDescendant(elementName, elementNamespace) && reader.Depth == depth;
         }
 
+        private static readonly XmlReaderSettings XmlSettings = new XmlReaderSettings()
+        {
+            DtdProcessing = DtdProcessing.Prohibit,
+            XmlResolver = null
+        };
+
         internal static AssemblyPortabilityPolicy LoadFromXml(Stream input)
         {
             // Note: Unlike Fusion XML reader the XmlReader doesn't allow whitespace in front of <?xml version=""1.0"" encoding=""utf-8"" ?>
 
             const string ns = "urn:schemas-microsoft-com:asm.v1";
 
-            using (XmlReader xml = XmlReader.Create(input))
+            using (XmlReader xml = XmlReader.Create(input, XmlSettings))
             {
                 if (!ReadToChild(xml, 0, "configuration") ||
                     !ReadToChild(xml, 1, "runtime") ||

Src/Compilers/Core/Desktop/CommandLine/RuleSet/RuleSetProcessor.cs

 // Copyright (c) Microsoft Open Technologies, Inc.  All Rights Reserved.  Licensed under the Apache License, Version 2.0.  See License.txt in the project root for license information.
 
-using System;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.IO;
-using System.Reflection;
 using System.Xml;
 using System.Xml.Schema;
 using Roslyn.Utilities;
@@ -54,9 +52,10 @@ internal class RuleSetProcessor
         /// </summary>
         private static XmlSchema CreateRuleSetSchema()
         {
-            Stream xsdStream = typeof(RuleSetProcessor).Assembly.GetManifestResourceStream(XsdResourceName);
-            XmlSchema xmlSchema = XmlSchema.Read(xsdStream, null);
-            return xmlSchema;
+            using (Stream xsdStream = typeof(RuleSetProcessor).Assembly.GetManifestResourceStream(XsdResourceName))
+            {
+                return XmlSchema.Read(xsdStream, null);
+            }
         }
 
         /// <summary>
@@ -155,11 +154,6 @@ private static RuleSet ReadRuleSet(XmlNode ruleSetNode, string filePath)
                 {
                     generalOption = ReadIncludeAll(childNode);
                 }
-                else
-                {
-                    // we are not interested in this node.
-                    continue;
-                }
             }
 
             return new RuleSet(filePath, generalOption, specificOptions, includes);
@@ -289,7 +283,7 @@ private static string ReadNonEmptyAttribute(XmlNode node, string attributeName)
         }
 
         /// <summary>
-        /// Gets the default settings to read the rulset xml file.
+        /// Gets the default settings to read the ruleset xml file.
         /// </summary>
         private static XmlReaderSettings GetDefaultXmlReaderSettings()
         {

Src/Compilers/Core/Portable/DocumentationComments/DocumentationCommentIncludeCache.cs

@@ -33,7 +33,7 @@ public XDocument GetOrMakeDocument(string resolvedPath)
             return GetOrMakeValue(resolvedPath).Value;
         }
 
-        private static XmlReaderSettings XmlSettings = new XmlReaderSettings()
+        private static readonly XmlReaderSettings XmlSettings = new XmlReaderSettings()
         {
             // Dev12 prohibits DTD
             DtdProcessing = DtdProcessing.Prohibit

Src/Compilers/Core/Portable/DocumentationComments/XmlDocumentationCommentTextReader.XmlStream.cs

@@ -3,8 +3,6 @@
 using System;
 using System.Diagnostics;
 using System.IO;
-using System.Runtime.InteropServices;
-using System.Text;
 using System.Xml;
 using Roslyn.Utilities;
 

Src/Compilers/Core/Portable/DocumentationComments/XmlDocumentationCommentTextReader.cs

 // Copyright (c) Microsoft Open Technologies, Inc.  All Rights Reserved.  Licensed under the Apache License, Version 2.0.  See License.txt in the project root for license information.
 
-using System;
 using System.Xml;
 using Roslyn.Utilities;
 

Src/Compilers/Core/VBCSCompilerTests/CompilerServerTests.cs

@@ -1864,7 +1864,10 @@ public async Task ServerRespectsAppConfig()
         {
             var exeConfigPath = Path.Combine(compilerDirectory, CompilerServerExeName + ".config");
             var doc = new XmlDocument();
-            doc.Load(exeConfigPath);
+            using (XmlReader reader = XmlReader.Create(exeConfigPath, new XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null }))
+            {
+                doc.Load(reader);
+            }
             var root = doc.DocumentElement;
 
             root.SelectSingleNode("appSettings/add/@value").Value = "1";

Src/Compilers/VisualBasic/Test/Semantic/Compilation/CompilationAPITests.vb

@@ -687,7 +687,7 @@ BC37221: Reference to 'a1.netmodule' netmodule missing.
         <WorkItem(718500, "DevDiv")>
         <WorkItem(716762, "DevDiv")>
         <Fact()>
-        Public Sub MissedModuleB_NoErrorForUnmagagedModules()
+        Public Sub MissedModuleB_NoErrorForUnmanagedModules()
             Dim netModule1 = CreateCompilationWithMscorlibAndVBRuntime(
 <compilation name="a1">
     <file name="a.vb">

Src/Compilers/VisualBasic/Test/Symbol/SymbolsTests/Source/EventTests.vb

@@ -645,7 +645,7 @@ BC30491: Expression does not produce a value.
         End Sub
 
         <Fact()>
-        Public Sub EvnetPrivateAccessor()
+        Public Sub EventPrivateAccessor()
             Dim ilSource = <![CDATA[
 .class public auto ansi beforefieldinit ClassLibrary1.Class1
        extends [mscorlib]System.Object
@@ -783,7 +783,7 @@ BC30456: 'E1' is not a member of 'Class1'.
         End Sub
 
         <Fact(Skip:="behaves as in Dev10 - unverifiable code. Should we do something more useful?")>
-        Public Sub EvnetProtectedAccessor()
+        Public Sub EventProtectedAccessor()
             Dim ilSource = <![CDATA[
 .class public auto ansi beforefieldinit ClassLibrary1.Class1
        extends [mscorlib]System.Object

Src/Test/Utilities/Win32Res.cs

@@ -8,8 +8,6 @@
 using System.IO;
 using System.Collections.Generic;
 
-using Microsoft.CodeAnalysis.Text;
-
 namespace Microsoft.CodeAnalysis.Test.Utilities
 {
     public class Win32Res
@@ -99,12 +97,12 @@ public static string ManifestResourceToXml(IntPtr mftRsrc, uint size)
                 xw.WriteEndElement();
                 xw.WriteEndDocument();
             }
-            var sw = new System.IO.StringWriter(System.Globalization.CultureInfo.InvariantCulture);
+            var sw = new StringWriter(System.Globalization.CultureInfo.InvariantCulture);
             doc.Save(sw);
             return sw.ToString();
         }
 
-        private static string ReadString(System.IO.BinaryReader reader)
+        private static string ReadString(BinaryReader reader)
         {
             int i = 0;
             var cbuffer = new char[16];
@@ -117,7 +115,7 @@ private static string ReadString(System.IO.BinaryReader reader)
             return new string(cbuffer).TrimEnd(new char[] { '\0' });
         }
 
-        private static void ReadVarFileInfo(System.IO.BinaryReader reader)
+        private static void ReadVarFileInfo(BinaryReader reader)
         {
             ushort us;
             string s;
@@ -132,7 +130,7 @@ private static void ReadVarFileInfo(System.IO.BinaryReader reader)
             us = reader.ReadUInt16();    //codepage; 1200 = CP_WINUNICODE
         }
 
-        public static IEnumerable<Tuple<string, string>> ReadStringFileInfo(System.IO.BinaryReader reader, int sizeTotalStringFileInfo)
+        public static IEnumerable<Tuple<string, string>> ReadStringFileInfo(BinaryReader reader, int sizeTotalStringFileInfo)
         {
             var result = new List<Tuple<string, string>>();
             int sizeConsumed = 2 + 2 + 2 + (16 * 2);
@@ -164,8 +162,8 @@ public static string VersionResourceToXml(IntPtr versionRsrc)
             var entireResourceBytes = new byte[size];
             Marshal.Copy(versionRsrc, entireResourceBytes, 0, entireResourceBytes.Length);
 
-            var memoryStream = new System.IO.MemoryStream(entireResourceBytes);
-            var reader = new System.IO.BinaryReader(memoryStream, Encoding.Unicode);
+            var memoryStream = new MemoryStream(entireResourceBytes);
+            var reader = new BinaryReader(memoryStream, Encoding.Unicode);
 
             XmlDocument doc = new XmlDocument();
             using (XmlWriter xw = doc.CreateNavigator().AppendChild())
@@ -175,9 +173,9 @@ public static string VersionResourceToXml(IntPtr versionRsrc)
                 xw.WriteAttributeString("Size", size.ToString());
 
                 //0x28 is the start of the VS_FIXEDFILEINFO
-                reader.BaseStream.Seek(0x28, System.IO.SeekOrigin.Begin);
+                reader.BaseStream.Seek(0x28, SeekOrigin.Begin);
                 //skip the first two dwords of VS_FIXEDFILEINFO.
-                reader.BaseStream.Seek(0x8, System.IO.SeekOrigin.Current);
+                reader.BaseStream.Seek(0x8, SeekOrigin.Current);
 
                 xw.WriteStartElement("VS_FIXEDFILEINFO");
                 xw.WriteAttributeString("FileVersionMS", String.Format("{0:x8}", reader.ReadUInt32()));
@@ -229,7 +227,7 @@ public static string VersionResourceToXml(IntPtr versionRsrc)
                 xw.WriteEndElement();
                 xw.WriteEndDocument();
             }
-            var sw = new System.IO.StringWriter(System.Globalization.CultureInfo.InvariantCulture);
+            var sw = new StringWriter(System.Globalization.CultureInfo.InvariantCulture);
             doc.Save(sw);
             return sw.ToString();
         }

Src/Tools/Source/CompilerGeneratorTools/Source/BoundTreeGenerator/Program.cs

@@ -49,7 +49,7 @@ static void Main(string[] args)
             serializer.UnreferencedObject += new UnreferencedObjectEventHandler(serializer_UnreferencedObject);
 
             Tree tree;
-            using (var reader = new XmlTextReader(infilename))
+            using (var reader = new XmlTextReader(infilename) { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null })
             {
                 tree = (Tree)serializer.Deserialize(reader);
             }

Src/Tools/Source/CompilerGeneratorTools/Source/CSharpSyntaxGenerator/Program.cs

@@ -12,7 +12,6 @@ namespace CSharpSyntaxGenerator
 {
     internal static class Program
     {
-
         public static void Main(string[] args)
         {
             if (args.Length < 2 || args.Length > 3)
@@ -61,7 +60,7 @@ public static void Main(string[] args)
                 }
             }
 
-            var reader = new XmlTextReader(inputFile);
+            var reader = new XmlTextReader(inputFile) { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null };
             var serializer = new XmlSerializer(typeof(Tree));
             Tree tree = (Tree)serializer.Deserialize(reader);
 

Src/Tools/Source/CompilerGeneratorTools/Source/VisualBasicSyntaxGenerator/XML/ReadTree.vb

@@ -70,6 +70,8 @@ Public Module ReadTree
         Using schemaReader = XmlReader.Create(Assembly.GetExecutingAssembly().GetManifestResourceStream("VBSyntaxModelSchema.xsd"))
 
             Dim readerSettings As New XmlReaderSettings()
+            readerSettings.DtdProcessing = DtdProcessing.Prohibit
+            readerSettings.XmlResolver = Nothing
             readerSettings.Schemas.Add(Nothing, schemaReader)
             readerSettings.ValidationType = ValidationType.Schema
             AddHandler readerSettings.ValidationEventHandler, AddressOf ValidationError

Src/Workspaces/Core/Shared/Utilities/DocumentationComment.cs

@@ -3,7 +3,6 @@
 using System;
 using System.Collections.Generic;
 using System.Collections.Immutable;
-using System.IO;
 using System.Xml;
 using XmlNames = Roslyn.Utilities.DocumentationCommentXmlNames;
 
@@ -243,8 +242,6 @@ public string GetParameterText(string parameterName)
         /// <summary>
         /// Returns the text for a given type parameter, or null if no documentation was given for the type parameter.
         /// </summary>
-        /// <param name="typeParameterName"></param>
-        /// <returns></returns>
         public string GetTypeParameterText(string typeParameterName)
         {
             string text;

Src/Workspaces/Core/Shared/Utilities/XmlFragmentParser.cs

@@ -43,13 +43,19 @@ public static void ParseFragment<TArg>(string xmlFragment, Action<XmlReader, TAr
             }
         }
 
+        private static readonly XmlReaderSettings XmlSettings = new XmlReaderSettings()
+        {
+            DtdProcessing = DtdProcessing.Prohibit,
+            XmlResolver = null
+        };
+
         private void ParseInternal<TArg>(string text, Action<XmlReader, TArg> callback, TArg arg)
         {
             textReader.SetText(text);
 
             if (xmlReader == null)
             {
-                xmlReader = XmlReader.Create(textReader);
+                xmlReader = XmlReader.Create(textReader, XmlSettings);
             }
 
             try

Src/Workspaces/Core/Utilities/CompilerUtilities/NonReentrantLock.cs

@@ -16,7 +16,7 @@ namespace Roslyn.Utilities
     /// use Windows kernel synchronization primitives.
     /// </para>
     /// <para>
-    /// The implementation is distilled from the workings of <see cref="T:System.Threading.SemaphoreSlim"/>
+    /// The implementation is distilled from the workings of <see cref="SemaphoreSlim"/>
     /// The basic idea is that we use a regular sync object (Monitor.Enter/Exit) to guard the setting
     /// of an 'owning thread' field. If, during the Wait, we find the lock is held by someone else
     /// then we register a cancellation callback and enter a "Monitor.Wait" loop. If the cancellation
@@ -31,8 +31,8 @@ namespace Roslyn.Utilities
     internal sealed class NonReentrantLock
     {
         /// <summary>
-        /// A synchronization object to protect access to the <see cref="F:owningThread"/> field and to be pulsed
-        /// when <see cref="M:Release"/> is called and during cancellation.
+        /// A synchronization object to protect access to the <see cref="owningThread"/> field and to be pulsed
+        /// when <see cref="Release"/> is called and during cancellation.
         /// </summary>
         private readonly object syncLock;
 
@@ -62,17 +62,17 @@ public NonReentrantLock(bool useThisInstanceForSynchronization = false)
 
         /// <summary>
         /// Blocks the current thread until it can enter the <see cref="NonReentrantLock"/>, while observing a
-        /// <see cref="T:System.Threading.CancellationToken"/>.
+        /// <see cref="CancellationToken"/>.
         /// </summary>
         /// <remarks>
         /// Recursive locking is not supported. i.e. A thread may not call Wait successfully twice without an
         /// intervening <see cref="Release"/>.
         /// </remarks>
-        /// <param name="cancellationToken">The <see cref="T:System.Threading.CancellationToken"/> token to
+        /// <param name="cancellationToken">The <see cref="CancellationToken"/> token to
         /// observe.</param>
-        /// <exception cref="T:System.OperationCanceledException"><paramref name="cancellationToken"/> was
+        /// <exception cref="OperationCanceledException"><paramref name="cancellationToken"/> was
         /// canceled.</exception>
-        /// <exception cref="T:System.LockRecursionException">The caller already holds the lock</exception>
+        /// <exception cref="LockRecursionException">The caller already holds the lock</exception>
         public void Wait(CancellationToken cancellationToken = default(CancellationToken))
         {
             if (this.IsOwnedByMe)
@@ -137,7 +137,7 @@ public void Wait(CancellationToken cancellationToken = default(CancellationToken
         /// <remarks>
         /// The calling thread must currently hold the lock.
         /// </remarks>
-        /// <exception cref="T:Roslyn.Utilities.ContractFailureException">The lock is not currently held by the calling thread.</exception>
+        /// <exception cref="Contract.ContractFailureException">The lock is not currently held by the calling thread.</exception>
         public void Release()
         {
             AssertHasLock();
@@ -163,7 +163,7 @@ public bool LockHeldByMe()
         /// <summary>
         /// Throw an exception if the lock is not held by the calling thread.
         /// </summary>
-        /// <exception cref="T:Roslyn.Utilities.ContractFailureException">The lock is not currently held by the calling thread.</exception>
+        /// <exception cref="Contract.ContractFailureException">The lock is not currently held by the calling thread.</exception>
         public void AssertHasLock()
         {
             Contract.ThrowIfFalse(LockHeldByMe());
@@ -213,12 +213,12 @@ private void ReleaseOwnership()
         /// <summary>
         /// Action object passed to a cancellation token registration.
         /// </summary>
-        private static readonly Action<object> cancellationTokenCanceledEventHandler = new Action<object>(CancellationTokenCanceledEventHandler);
+        private static readonly Action<object> cancellationTokenCanceledEventHandler = CancellationTokenCanceledEventHandler;
 
         /// <summary>
         /// Callback executed when a cancellation token is canceled during a Wait.
         /// </summary>
-        /// <param name="obj">The syncLock that protects a <see cref="NonReentrantLock "/> instance.</param>
+        /// <param name="obj">The syncLock that protects a <see cref="NonReentrantLock"/> instance.</param>
         private static void CancellationTokenCanceledEventHandler(object obj)
         {
             lock (obj)

Src/Workspaces/Core/Utilities/Documentation/XmlDocumentationProvider.cs

@@ -3,12 +3,9 @@
 using System;
 using System.Collections.Generic;
 using System.Globalization;
-using System.IO;
 using System.Linq;
 using System.Threading;
 using System.Xml;
-using Microsoft.CodeAnalysis;
-using Microsoft.CodeAnalysis.Text;
 using Roslyn.Utilities;
 
 namespace Microsoft.CodeAnalysis
@@ -59,6 +56,12 @@ protected override string GetDocumentationForSymbol(string documentationMemberID
             return this.docComments.TryGetValue(documentationMemberID, out docComment) ? docComment : "";
         }
 
+        private static readonly XmlReaderSettings XmlSettings = new XmlReaderSettings()
+        {
+            DtdProcessing = DtdProcessing.Prohibit,
+            XmlResolver = null
+        };
+
         private sealed class FileBasedXmlDocumentationProvider : XmlDocumentationProvider
         {
             private readonly string filePath;
@@ -74,7 +77,11 @@ public FileBasedXmlDocumentationProvider(string filePath)
             protected override XmlDocument GetXmlDocument()
             {
                 var doc = new XmlDocument();
-                doc.Load(this.filePath);
+                using (XmlReader reader = XmlReader.Create(this.filePath, XmlSettings))
+                {
+                    doc.Load(reader);
+                }
+
                 return doc;
             }
 
@@ -104,9 +111,10 @@ public ContentBasedXmlDocumentationProvider(byte[] xmlDocCommentBytes)
             protected override XmlDocument GetXmlDocument()
             {
                 using (var stream = SerializableBytes.CreateReadableStream(this.xmlDocCommentBytes, CancellationToken.None))
+                using (var xmlReader = XmlReader.Create(stream, XmlSettings))
                 {
                     var doc = new XmlDocument();
-                    doc.Load(stream);
+                    doc.Load(xmlReader);
                     return doc;
                 }
             }
@@ -144,7 +152,7 @@ private bool EqualsHelper(ContentBasedXmlDocumentationProvider other)
 
             public override int GetHashCode()
             {
-                return this.xmlDocCommentBytes.GetHashCode();
+                return Hash.CombineValues(this.xmlDocCommentBytes);
             }
         }
     }

Src/Workspaces/Core/Workspace/MSBuild/ProjectFile/ProjectFileLoader.cs

@@ -7,18 +7,14 @@
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using System.Xml;
 using Microsoft.CodeAnalysis;
-using Microsoft.CodeAnalysis.Text;
 using MSB = Microsoft.Build;
 
 namespace Microsoft.CodeAnalysis.MSBuild
 {
     internal abstract class ProjectFileLoader : IProjectFileLoader
     {
-        public ProjectFileLoader()
-        {
-        }
-
         public abstract string Language { get; }
 
         protected abstract ProjectFile CreateProjectFile(MSB.Evaluation.Project loadedProject);
@@ -36,13 +32,19 @@ public async Task<IProjectFile> LoadProjectFileAsync(string path, IDictionary<st
             return this.CreateProjectFile(loadedProject);
         }
 
+        private static readonly XmlReaderSettings XmlSettings = new XmlReaderSettings()
+        {
+            DtdProcessing = DtdProcessing.Prohibit,
+            XmlResolver = null
+        };
+
         private static async Task<MSB.Evaluation.Project> LoadProjectAsync(string path, IDictionary<string, string> globalProperties, CancellationToken cancellationToken)
         {
             var properties = new Dictionary<string, string>(globalProperties ?? ImmutableDictionary<string, string>.Empty);
             properties["DesignTimeBuild"] = "true"; // this will tell msbuild to not build the dependent projects
             properties["BuildingInsideVisualStudio"] = "true"; // this will force CoreCompile task to execute even if all inputs and outputs are up to date
 
-            var xmlReader = System.Xml.XmlReader.Create(await ReadFileAsync(path, cancellationToken).ConfigureAwait(false));
+            var xmlReader = XmlReader.Create(await ReadFileAsync(path, cancellationToken).ConfigureAwait(false), XmlSettings);
             var collection = new MSB.Evaluation.ProjectCollection();
             var xml = MSB.Construction.ProjectRootElement.Create(xmlReader, collection);