Ban XmlReader overloads that take string

src/BannedSymbols.txt

@@ -1,2 +1,7 @@
 M:System.Globalization.CompareInfo.IndexOf(System.String,System.Char);CompareInfo.IndexOf can unexpectedly allocate strings--use string.IndexOf
 P:Microsoft.Build.Construction.ProjectElementContainer.Children;Use ChildrenEnumerable instead to avoid boxing
+M:System.Xml.XmlReader.Create(System.String);Do not pass paths to XmlReader.Create--use the Stream overload
+M:System.Xml.XmlReader.Create(System.String,System.Xml.XmlReaderSettings);Do not pass paths to XmlReader.Create--use the Stream overload
+M:System.Xml.XmlReader.Create(System.String,System.Xml.XmlReaderSettings,System.Xml.XmlParserContext);Do not pass paths to XmlReader.Create--use the Stream overload
+M:System.Xml.XPath.XPathDocument.#ctor(System.String);Do not pass string paths to XPathDocument ctor--use the Stream overload
+M:System.Xml.XPath.XPathDocument.#ctor(System.String,System.Xml.XmlSpace);Do not pass string paths to XPathDocument ctor--use the Stream overload

src/Tasks/GenerateResource.cs

@@ -42,6 +42,7 @@
 using Microsoft.Build.Utilities;
 #if FEATURE_RESXREADER_LIVEDESERIALIZATION
 using Microsoft.Win32;
+using System.Windows.Forms;
 #endif
 
 #nullable disable
@@ -1745,9 +1746,10 @@ private bool NeedSeparateAppDomain()
 
                     try
                     {
-                        XmlReaderSettings readerSettings = new XmlReaderSettings();
-                        readerSettings.DtdProcessing = DtdProcessing.Ignore;
-                        reader = XmlReader.Create(source.ItemSpec, readerSettings);
+                        XmlReaderSettings readerSettings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Ignore, CloseInput = true };
+
+                        FileStream fs = File.OpenRead(source.ItemSpec);
+                        reader = XmlReader.Create(fs, readerSettings);
 
                         while (reader.Read())
                         {

src/Tasks/XamlTaskFactory/RelationsParser.cs

@@ -6,6 +6,9 @@
 using System.IO;
 using System.Xml;
 using Microsoft.Build.Shared;
+using Microsoft.Build.Tasks.Deployment.ManifestUtilities;
+using Microsoft.IO;
+using File = System.IO.File;
 
 #nullable disable
 
@@ -174,17 +177,21 @@ internal class RelationsParser
         #endregion
 
         /// <summary>
-        /// The method that loads in an XML file
+        /// The method that loads in an XML file.
         /// </summary>
-        /// <param name="fileName">the xml file containing switches and properties</param>
-        private XmlDocument LoadFile(string fileName)
+        /// <param name="filePath">the xml file containing switches and properties.</param>
+        private XmlDocument LoadFile(string filePath)
         {
             try
             {
                 var xmlDocument = new XmlDocument();
-                XmlReaderSettings settings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Ignore };
-                XmlReader reader = XmlReader.Create(fileName, settings);
-                xmlDocument.Load(reader);
+                XmlReaderSettings settings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Ignore, CloseInput = true };
+                FileStream fs = File.OpenRead(filePath);
+                using (XmlReader reader = XmlReader.Create(fs, settings))
+                {
+                    xmlDocument.Load(reader);
+                }
+
                 return xmlDocument;
             }
             catch (FileNotFoundException e)
@@ -211,6 +218,7 @@ internal XmlDocument LoadXml(string xml)
                 XmlReaderSettings settings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Ignore };
                 XmlReader reader = XmlReader.Create(new StringReader(xml), settings);
                 xmlDocument.Load(reader);
+
                 return xmlDocument;
             }
             catch (XmlException e)
@@ -221,7 +229,7 @@ internal XmlDocument LoadXml(string xml)
         }
 
         /// <summary>
-        /// Parses the xml file
+        /// Parses the xml file.
         /// </summary>
         public bool ParseXmlDocument(string fileName)
         {