microsoft · rpetrusha · Feb 27, 2018 · Oct 25, 2017 · Oct 25, 2017 · Oct 25, 2017
diff --git a/Documentation/compatibility/! Template.md b/Documentation/compatibility/! Template.md
@@ -6,7 +6,7 @@
 
 ### Scope
 [|Major|Minor|Edge|Transparent|]
-//A description of the Scope values can be found at https://docs.microsoft.com/en-us/dotnet/articles/framework/migration-guide/net-compatibility-diagnostics
+//A description of the Scope values can be found at https://docs.microsoft.com/dotnet/articles/framework/migration-guide/net-compatibility-diagnostics
 
 ### Version Introduced
 [|Version in which the breaking change first occurred|]
@@ -39,7 +39,7 @@
 [| List of APIs affected by change referred to using docids|]
 
 // For details on how to generate docids, please look at other change files or
-// see https://msdn.microsoft.com/en-us/library/fsbx0t7x.aspx for the spec.
+// see https://msdn.microsoft.com/library/fsbx0t7x.aspx for the spec.
 //
 // For example, if all members of System.Xml.XmlTextReader is affected, we would have the following item:
 // * `T:System.Xml.XmlTextReader`

diff --git a/Documentation/compatibility/ASPNET-accessibility-improvement.md b/Documentation/compatibility/ASPNET-accessibility-improvement.md
@@ -27,20 +27,20 @@ Starting with the .NET Framework 4.7.1, ASP.NET has improved how ASP.NET Web Con
 
 ### Recommended Action
 
-**How to opt in or out of these changes**
-
+**How to opt in or out of these changes** 
+  
 In order for the Visual Studio Designer to benefit from these changes, it must run on the .NET Framework 4.7.1 or later. The web application can benefit from these changes in either of the following ways:
 
 - Install Visual Studio 2017 15.3 or later, which supports the new accessibility features with the following AppContext Switch by default.
 
-- Opt out of the legacy accessibility behaviors by adding the `Switch.UseLegacyAccessibility` AppContext switch to the `<runtime>` section in the devenv.exe.config file and setting it to `false`, as the following example shows.
+- Opt out of the legacy accessibility behaviors by adding the `Switch.UseLegacyAccessibilityFeatures` AppContext switch to the `<runtime>` section in the devenv.exe.config file and setting it to `false`, as the following example shows.
 
 ```xml
 <?xml version="1.0" encoding="utf-8"?>
 <configuration>
   <runtime>
     ...
-    <!-- AppContextSwitchOverrides value attribute is in the form of 'key1=true|false;key2=true|false  -->
+    <!-- AppContextSwitchOverrides value attribute is in the form of `key1=true|false;key2=true|false`  -->
     <AppContextSwitchOverrides value="...;Switch.UseLegacyAccessibilityFeatures=false" />
     ...
   </runtime>

diff --git a/...on/compatibility/Change-SignedXML-and-SignedCMS-default-algorithms-to-SHA256.md b/...on/compatibility/Change-SignedXML-and-SignedCMS-default-algorithms-to-SHA256.md
@@ -10,7 +10,7 @@ Minor
 NotPlanned
 
 ### Change Description
-In the .NET Framework 4.7 and earlier, SignedXML and SignedCMS default to SHA1 for some operations.
+In the .NET Framework 4.7 and earlier, SignedXML and SignedCMS default to SHA1 for some operations.  
 
 Starting with the .NET Framework 4.7.1, SHA256 is enabled by default for these operations. This change is necessary because SHA1 is no longer considered to be secure.
 
@@ -24,13 +24,13 @@ There are two new context switch values to control whether SHA1 (insecure) or SH
 
 - Switch.System.Security.Cryptography.Pkcs.UseInsecureHashAlgorithms
 
-For applications that target the .NET Framework 4.7.1 and later versions, if the use of SHA256 is undesirable, you can restore the default to SHA1 by adding the following configuration switch to the [runtime](https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/runtime/runtime-element) section of your app config file:
+For applications that target the .NET Framework 4.7.1 and later versions, if the use of SHA256 is undesirable, you can restore the default to SHA1 by adding the following configuration switch to the [runtime](~/docs/framework/configure-apps/file-schema/runtime/runtime-element.md) section of your app config file:
 
 ```xml
 <AppContextSwitchOverrides value="Switch.System.Security.Cryptography.Xml.UseInsecureHashAlgorithms=true;Switch.System.Security.Cryptography.Pkcs.UseInsecureHashAlgorithms=true" /> 
 ```
 
-For applications that target the .NET Framework 4.7 and earlier versions, you can opt into this change by adding the following configuration switch to the [runtime](https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/runtime/runtime-element) section of your app config file:
+For applications that target the .NET Framework 4.7 and earlier versions, you can opt into this change by adding the following configuration switch to the [runtime](~/docs/framework/configure-apps/file-schema/runtime/runtime-element.md) section of your app config file:
 
 ```xml
 <AppContextSwitchOverrides value="Switch.System.Security.Cryptography.Xml.UseInsecureHashAlgorithms=false;Switch.System.Security.Cryptography.Pkcs.UseInsecureHashAlgorithms=false" /> 

diff --git a/Documentation/compatibility/README.md b/Documentation/compatibility/README.md
@@ -93,6 +93,7 @@ Please help us improve the [.NET Framework Application Compatibility documents](
 - [Attempting a TCP/IP connection to a SQL Server database that resolves to `localhost` fails](sql-server-database-connection-that-resolves-to-localhost.md)
 - [Calling Attribute.GetCustomAttributes on an indexer property no longer throws AmbiguousMatchException if the ambiguity can be resolved by index's type](calling-attribute_getcustomattributes-on-an-indexer-property-no-longer-throws-ambiguousmatchexception.md)
 - [Calling CreateDefaultAuthorizationContext with a null argument has changed](calling-createdefaultauthorizationcontext-with-a-null-argument-has-changed.md)
+- [Certificate EKU OID validation](certificate-eku-oid-validation.md)
 - [ClickOnce supports SHA-256 on 4.0-targeted apps](clickonce-supports-sha-256-on-4_0-targeted-apps.md)
 - [CoerceIsSelectionBoxHighlighted](coerceisselectionboxhighlighted.md)
 - [ContentDisposition DateTimes returns slightly different string](contentdisposition-datetimes-returns-slightly-different-string.md)
@@ -110,7 +111,8 @@ Please help us improve the [.NET Framework Application Compatibility documents](
 - [Reflection objects can no longer be passed from managed code to out-of-process DCOM clients](reflection-objects-can-no-longer-be-passed-from-managed-code-to-out-of-process-dcom-clients.md)
 - [TargetFrameworkName for default app domain no longer defaults to null if not set](targetframeworkname-for-default-app-domain-no-longer-defaults-to-null-if-not-set.md)
 - [The .NET Framework 4.6 does not use a 4.5.x.x version when registering itself in the registry](the-_net-framework-4_6-does-not-use-a-4_5_x_x-version-when-registering-itself-in-the-registry.md)
-- [WCF services that use NETTCP with SSL sercurity and MD5 certificate authentication](wcf-services-using-nettcp-with-ssl-security-and-md5-certificate-authentication.md)
+- [TLS 1.x by default passes the SCH_SEND_AUX_RECORD flag to the underlying SCHANNEL API](tls-1-x-by-default-passes-sch-send-aux-record-flag-to-the-underlying-schannel-api.md)
+- [WCF services that use NETTCP with SSL security and MD5 certificate authentication](wcf-services-using-nettcp-with-ssl-security-and-md5-certificate-authentication.md)
 - [WPF layout rounding of margins has changed](wpf-layout-rounding-of-margins-has-changed.md)
 - [WPF spell checking in text-enabled controls will not work in Windows 10 for languages not in the OS's input language list](wpf-spell-checking-in-text-enabled-controls-will-not-work-in-windows-10-for-languages-not-in-the-input-language-list.md)
 - [WPF windows are rendered without clipping when extending outside a single monitor](wpf-windows-are-rendered-without-clipping-when-extending-outside-a-single-monitor.md)

diff --git a/Documentation/compatibility/SerialPort-background-thread-exceptions.md b/Documentation/compatibility/SerialPort-background-thread-exceptions.md
@@ -10,9 +10,9 @@ Minor
 NotPlanned
 
 ### Change Description
-Background threads created with <xref:System.IO.Ports.SerialPort> streams no longer terminate the process when OS exceptions are thrown.
+Background threads created with <xref:System.IO.Ports.SerialPort> streams no longer terminate the process when OS exceptions are thrown.  
 
-In applications that target the .NET Framework 4.7 and earlier versions, a process is terminated when an operating system exception is thrown on a background thread created with a <xref:System.IO.Ports.SerialPort> stream.
+In applications that target the .NET Framework 4.7 and earlier versions, a process is terminated when an operating system exception is thrown on a background thread created with a <xref:System.IO.Ports.SerialPort> stream.  
 
 In applications that target the .NET Framework 4.7.1 or a later version, background threads wait for OS events related to the active serial port and could crash in some cases, such as sudden removal of the serial port. 
 
@@ -21,15 +21,15 @@ In applications that target the .NET Framework 4.7.1 or a later version, backgro
 
 ### Recommended Action
 
-For apps that target the .NET Framework 4.7.1, you can opt out of the exception handling if it is not desirable by adding the following to to the `<runtime>` section of your `app.config` file:
+For apps that target the .NET Framework 4.7.1, you can opt out of the exception handling if it is not desirable by adding the following to the `<runtime>` section of your `app.config` file:
 
 ```xml
 <runtime>
    <AppContextSwitchOverrides value="Switch.System.IO.Ports.DoNotCatchSerialStreamThreadExceptions=true" />
 </runtime>
 ```
 
-For apps that target earlier versions of the .NET Framework but run on the .NET Framework 4.7.1 or later, you can opt in to the exception handling by adding the following to to the `<runtime>` section of your `app.config` file:
+For apps that target earlier versions of the .NET Framework but run on the .NET Framework 4.7.1 or later, you can opt in to the exception handling by adding the following to the `<runtime>` section of your `app.config` file:
 
 ```xml
 <runtime>

diff --git a/Documentation/compatibility/ServiceBase-doesnt-propagate-OnStart-exceptions.md b/Documentation/compatibility/ServiceBase-doesnt-propagate-OnStart-exceptions.md
@@ -13,9 +13,9 @@ NotPlanned
 
 ### Change Description
 
-In the .NET Framework 4.7 and earlier versions, exceptions thrown on service startup are not propagated to the caller of <xref:System.ServiceProcess.Servicebase.Run?displayProperty=nameWithType>.
+In the .NET Framework 4.7 and earlier versions, exceptions thrown on service startup are not propagated to the caller of <xref:System.ServiceProcess.ServiceBase.Run%2A?displayProperty=nameWithType>.
 
-Starting with applications that target the .NET Framework 4.7.1, the runtime propagates exceptions to <xref:System.ServiceProcess.Servicebase.Run?displayProperty=nameWithType> for services that fail to start.
+Starting with applications that target the .NET Framework 4.7.1, the runtime propagates exceptions to <xref:System.ServiceProcess.ServiceBase.Run%2A?displayProperty=nameWithType> for services that fail to start.
 
 - [x] Quirked
 - [ ] Build-time break

diff --git a/Documentation/compatibility/SignedXml.GetPublicKey-returns-RSACng-on-net462.md b/Documentation/compatibility/SignedXml.GetPublicKey-returns-RSACng-on-net462.md
@@ -14,14 +14,14 @@ NotPlanned
 
 ### Change Description
 
-Starting with the .NET Framework 4.6.2, the concrete type of the object returned by the <xref:System.Security.Cryptography.Xml.SignedXml.GetPublicKey%2A?displayProperty=nameWithType> method changed (without a quirk) from a CryptoServiceProvider implementation to a Cng implementation. This is because the implementation changed from using `certificate.PublicKey.Key` to using the internal `certificate.GetAnyPublicKey` which forwards to <xref:System.Security.Cryprography.X509Certificates.RSACertificateExtensions.GetRSAPublicKey%2A?displayProperty=nameWithType>.
+Starting with the .NET Framework 4.6.2, the concrete type of the object returned by the <xref:System.Security.Cryptography.Xml.SignedXml.GetPublicKey%2A?displayProperty=nameWithType> method changed (without a quirk) from a CryptoServiceProvider implementation to a Cng implementation. This is because the implementation changed from using `certificate.PublicKey.Key` to using the internal `certificate.GetAnyPublicKey` which forwards to <xref:System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPublicKey%2A?displayProperty=nameWithType>.
 
 - [x] Quirked
 - [ ] Build-time break
 
 ### Recommended Action
 
-Starting with apps running on the .NET Framework 4.7.1, you can use the CryptoServiceProvider implementation used by default in the .NET Framework 4.6.1 and earlier versions by adding the following configuration switch to the [runtime](https://docs.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/runtime/runtime-element) section of your app config file:
+Starting with apps running on the .NET Framework 4.7.1, you can use the CryptoServiceProvider implementation used by default in the .NET Framework 4.6.1 and earlier versions by adding the following configuration switch to the [runtime](~/docs/framework/configure-apps/file-schema/runtime/runtime-element.md) section of your app config file:
 
 ```xml
 <AppContextSwitchOverrides value="Switch.System.Security.Cryptography.Xml.SignedXmlUseLegacyCertificatePrivateKey=true" />

diff --git a/...llection-now-throws-an-ArgumentException-if-an-addressHeader-element-is-null.md b/...llection-now-throws-an-ArgumentException-if-an-addressHeader-element-is-null.md
@@ -10,7 +10,7 @@ Minor
 NotPlanned
 
 ### Change Description
-Starting with the .NET Framework 4.7.1, the `M:System.ServiceModel.Channels.AddressHeaderCollection.#ctor(System.Collections.Generic.IEnumerable{System.ServiceModel.Channels.AddressHeader})` constructor throws an `T:System.ArgumentException` if one of the elements is `null`. In the .NET Framework 4.7 and earlier versions, no exception is thrown.
+Starting with the .NET Framework 4.7.1, the <xref:System.ServiceModel.Channels.AddressHeaderCollection.#ctor(System.Collections.Generic.IEnumerable{System.ServiceModel.Channels.AddressHeader})> constructor throws an <xref:System.ArgumentException> if one of the elements is `null`. In the .NET Framework 4.7 and earlier versions, no exception is thrown.
 
 ### Recommended Action
 If you encounter compatibility issues with this change on the .NET Framework 4.7.1 or a later version, you can opt-out of it by adding the following line to the `<runtime>` section of the app.config file::
@@ -27,7 +27,7 @@ If you encounter compatibility issues with this change on the .NET Framework 4.7
 * `M:System.ServiceModel.Channels.AddressHeaderCollection.#ctor(System.Collections.Generic.IEnumerable{System.ServiceModel.Channels.AddressHeader})`
 
 ### Category
-* Windows Communication Foundation (WCF)
+Windows Communication Foundation (WCF)
 
 <!--
     ### Original Bug

diff --git a/...tation/compatibility/WCF-MsmqSecureHashAlgorithm-default-value-is-now-SHA256.md b/...tation/compatibility/WCF-MsmqSecureHashAlgorithm-default-value-is-now-SHA256.md
@@ -9,6 +9,9 @@ NotPlanned
 ### Change Description
 Starting with the .NET Framework 4.7.1, the default message signing algorithm in WCF for Msmq messages is SHA256. In the .NET Framework 4.7 and earlier versions, the default message signing algorithm is SHA1.
 
+- [ ] Quirked
+- [ ] Build-time break
+
 ### Recommended Action
 If you run into compatibility issues with this change on the .NET Framework 4.7.1 or later, you can opt-out the change by adding the following line to the `<runtime>`section of your app.config file:
 
@@ -25,7 +28,7 @@ If you run into compatibility issues with this change on the .NET Framework 4.7.
 * Not detectable via API analysis
 
 ### Category
-* Windows Communication Foundation (WCF)
+Windows Communication Foundation (WCF)
 
 <!--
     ### Original Bug

diff --git a/Documentation/compatibility/WCF-PipeConnection.GetHashAlgorithm-now-uses-SHA256.md b/Documentation/compatibility/WCF-PipeConnection.GetHashAlgorithm-now-uses-SHA256.md
@@ -9,6 +9,9 @@ NotPlanned
 ### Change Description
 Starting with the .NET Framework 4.7.1, Windows Communication Foundation uses a SHA256 hash to generate random names for named pipes. In the .NET Framework 4.7 and earlier versions, it used a SHA1 hash.
 
+- [ ] Quirked
+- [ ] Build-time break
+
 ### Recommended Action
 If you run into compatibility issue with this change on the .NET Framework 4.7.1 or later, you can opt-out it by adding the following line to the `<runtime>` section of your app.config file:
 
@@ -24,7 +27,7 @@ If you run into compatibility issue with this change on the .NET Framework 4.7.1
 * Not detectable via API analysis
 
 ### Category
-* Windows Communication Foundation (WCF)
+Windows Communication Foundation (WCF)
 
 <!--
     ### Original Bug

diff --git a/...ger-throws-for-re-entrant-implementations-of-imessagefilter_prefiltermessage.md b/...ger-throws-for-re-entrant-implementations-of-imessagefilter_prefiltermessage.md
@@ -38,7 +38,7 @@ Framework 4.6.1.
 
 Apps targeting the .NET Framework 4.6.1 can opt out of this change (or apps
 targeting older Frameworks may opt in) by using the
-[DontSupportReentrantFilterMessage](https://docs.microsoft.com/en-us/dotnet/articles/framework/migration-guide/mitigation-custom-imessagefilter-prefiltermessage-implementations#mitigation)
+[DontSupportReentrantFilterMessage](~/docs/framework/migration-guide/mitigation-custom-imessagefilter-prefiltermessage-implementations#mitigation)
 compatibility switch.
 
 ### Affected APIs

diff --git a/...ity/asp_net-mvc-now-escapes-spaces-in-strings-passed-in-via-route-parameters.md b/...ity/asp_net-mvc-now-escapes-spaces-in-strings-passed-in-via-route-parameters.md
@@ -19,13 +19,11 @@ In order to conform to RFC 2396, spaces in route paths are now escaped when popu
 Code should be updated to unescape string parameters from a route. If the original URI is needed, it can be accessed with the <xref:System.Net.HttpWebRequest.RequestUri>.OriginalString API.
 
 ### Affected APIs
-* `M:System.Web.Http.RouteAttribute.#ctor(System.String)`
+* `M:System.Web.Mvc.RouteAttribute.#ctor(System.String)`
 
 ### Category
 ASP.NET
 
-[More information](http://connect.microsoft.com/VisualStudio/feedback/details/878827/issues-with-encoding-in-web-api-in-4-5-2)
-
 <!--
     ### Notes
     Single-diagnostic compilation action analyzer

diff --git a/...elector-property-(such-as-'selecteditem')-to-a-static-property-does-not-work.md b/...elector-property-(such-as-'selecteditem')-to-a-static-property-does-not-work.md
@@ -27,7 +27,7 @@ This behavior was reverted in a servicing update for the .NET Framework 4.5. Ple
 ### Category
 Windows Presentation Foundation (WPF)
 
-[More information](https://social.msdn.microsoft.com/Forums/vstudio/en-US/56ff3199-5abc-454e-87f7-bafff43e7422/net-45-critical-selecteditem-not-setting-binding-item?forum=wpf)
+[More information](https://social.msdn.microsoft.com/Forums/vstudio/56ff3199-5abc-454e-87f7-bafff43e7422/net-45-critical-selecteditem-not-setting-binding-item?forum=wpf)
 
 <!--
     ### Notes

diff --git a/Documentation/compatibility/certificate-eku-oid-validation.md b/Documentation/compatibility/certificate-eku-oid-validation.md
@@ -0,0 +1,48 @@
+## Certificate EKU OID validation
+
+### Scope
+Minor
+
+### Version Introduced
+4.6
+
+### Source Analyzer Status
+NotPlanned
+
+### Change Description
+
+Starting with .NET Framework 4.6, the <xref:System.Net.Security.SslStream> or <xref:System.Net.ServicePointManager> classes perform enhanced key use (EKU) object identifier (OID) validation. An enhanced key usage (EKU) extension is a collection of object identifiers (OIDs) that indicate the applications that use the key. EKU OID validation uses remote certificate callbacks to ensure that the remote certificate has the correct OIDs for the intended purpose.
+
+- [X] Quirked
+- [ ] Build-time break
+
+### Recommended Action
+
+If this change is undesirable, you can disable certificate EKU OID validation by adding the following switch to the [`\<AppContextSwitchOverrides>` element](~/docs/framework/configure-apps/file-schema/runtime/appcontextswitchoverrides-element.md) in the [`\<runtime> section](~/docs/framework/configure-apps/file-schema/runtime/runtime-element.md) of your app configuration file:
+
+```xml
+<runtime>
+   <AppContextSwitchOverrides
+          value="Switch.System.Net.DontCheckCertificateEKUs=true" />
+</runtime>
+```
+> [!IMPORTANT]
+> This setting is provided for backward compatibility only. Its use is otherwise not recommended.
+
+
+### Affected APIs
+* `T:System.Net.Security.SslStream`
+* `T:System.Net.ServicePointManager`
+* `T:System.Net.Http.HttpClient`
+* `T:System.Net.Mail.SmtpClient`
+* `T:System.Net.HttpWebRequest`
+* `T:System.Net.FtpWebRequest`
+
+### Category
+Networking
+
+<!--
+    ### Original Bug #364538
+-->
+
+
diff --git a/Documentation/compatibility/change-in-path-separator-character-in-zip-files.md b/Documentation/compatibility/change-in-path-separator-character-in-zip-files.md
@@ -20,7 +20,7 @@ Decompressing a zip file created by an app that targets a previous version of th
 
 ### Recommended Action
 
-The impact of this change on .ZIP files that are decompressed on the Windows operating system by APIs in the .NET Framework <xref:System.IO?displayProperty=nameWithType> namespace should be minimal, since these APIs can seamlessly handle either a slash ("/") or a backslash ("\\") as the path separator character.
+The impact of this change on .ZIP files that are decompressed on the Windows operating system by APIs in the .NET Framework <xref:System.IO?displayProperty=nameWithType> namespace should be minimal, since these APIs can seamlessly handle either a slash ("/") or a backslash ("\\") as the path separator character.  
 
 If this change is undesirable, you can opt out of it by adding a configuration setting to the [`<runtime>`](https://docs.microsoft.com/dotnet/framework/configure-apps/file-schema/runtime/runtime-element.md) section of your application configuration file. The following example shows both the `<runtime` section and the `Switch.System.IO.Compression.ZipFile.UseBackslash` opt-out switch: