Publish list of APIs that are recommended for BannedApiAnalyzer

[timmydo]

Describe the bug

Migrations utilizing NoGetByIntNameValueCollection should also utilize a banned api analyzer to help prevent runtime exceptions.

Exceptions (if any)

Platform not supported exception

Further technical details

https://github.com/dotnet/roslyn-analyzers/blob/main/src/Microsoft.CodeAnalysis.BannedApiAnalyzers/BannedApiAnalyzers.Help.md

something like this for the banned symbols text file:

M:System.Collections.Specialized.NameValueCollection.Get(System.Int32);Don't use BannedType
M:System.Collections.Specialized.NameValueCollection.GetKey(System.Int32);Don't use BannedType
P:System.Collections.Specialized.NameValueCollection.Item(System.Int32);Don't use BannedType
M:System.Collections.Specialized.NameValueCollection.GetValues(System.Int32);Don't use BannedType
P:System.Collections.Specialized.NameValueCollection.Keys;Don't use BannedType
P:System.Collections.Specialized.NameObjectCollectionBase.Keys;Don't use BannedType
M:System.Collections.Specialized.NameValueCollection.#ctor(System.Collections.Specialized.NameValueCollection);Don't use BannedType
M:System.Collections.Specialized.NameValueCollection.Add(System.Collections.Specialized.NameValueCollection);Don't use BannedType

[adityamandaleeka]

@timmydo To help us decide whether something like this should be opt-out or opt-in, can you let us know how commonly you find false positives when enabling this in your build?

[timmydo]

in our application, I have found very few false positives because most people using NameValueCollection are using the ones in the http request or response. It's an easy enough workaround to switch the for loop to foreach. If Dictionary<> didn't exist, I'd probably be more worried about false positives. I don't think anyone should blindly be using the adapter without some sort of safeguard like this... in our code base we have at least 20 places that would throw runtime exceptions otherwise. Luckily, we have thousands of tests to catch it, and I might not be able to catch them all without having a banned api analyzer (and even that doesn't catch ones from nuget packages). I did find a nuget package that caused runtime exceptions.

I wouldn't recommend using systemweb adapters in good conscience without recommending something like the banned api analyzer along with it... so that would probably be a vote for opt-out behavior from me. Otherwise, you'll need to fix the adapter to not throw runtime exceptions.

I think I sent you and Chris a link to a PR with the changes I made to make the banned api analyzer happy. You could get an idea of what I changed based on that.

[adityamandaleeka]

Triage: we can use this issue to track APIs that we think would be useful to include in a BannedApiAnalyzer list when doing a migration.

[adityamandaleeka]

See #251