diff --git a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll
index 798a8ed38222..4c4e21914a8e 100644
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/system/Xml.qll
@@ -141,23 +141,43 @@ class XmlReaderSettingsCreation extends ObjectCreation {
 
   /** Gets a value set on the `ValidationType` property, if any. */
   SystemXmlValidationType getValidationType() {
-    result.getAnAccess() =
+    result.getAnAccess() = this.getAValidationTypeValue()
+  }
+
+  /** Gets an expression assigned to the `ValidationType` property in this local context. */
+  Expr getAValidationTypeValue() {
+    result =
       this.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationTypeProperty())
   }
 
   /** Gets a flag set on the `ValidationFlags` property, if any. */
   SystemXmlSchemaXmlSchemaValidationFlags getAValidationFlag() {
-    result.getAnAccess() =
+    result.getAnAccess() = this.getAValidationFlagValue()
+  }
+
+  /** Gets an expression assigned to the `ValidationFlags` property in this local context. */
+  Expr getAValidationFlagValue() {
+    result =
       this.getPropertyValue(any(SystemXmlXmlReaderSettingsClass s).getValidationFlagsProperty())
   }
 
   /** Gets a value set for the given property in this local context. */
   private Expr getPropertyValue(Property p) {
     p = settings.getAProperty() and
-    exists(PropertyCall set, Expr arg |
-      set.getTarget() = p.getSetter() and
-      DataFlow::localExprFlow(this, set.getQualifier()) and
-      arg = set.getAnArgument() and
+    exists(Expr arg |
+      (
+        exists(PropertyCall set |
+          set.getTarget() = p.getSetter() and
+          DataFlow::localExprFlow(this, set.getQualifier()) and
+          arg = set.getAnArgument()
+        )
+        or
+        exists(MemberInitializer initializer |
+          initializer = this.getInitializer().(ObjectInitializer).getAMemberInitializer() and
+          initializer.getInitializedMember() = p and
+          arg = initializer.getRightOperand()
+        )
+      ) and
       result = getBitwiseOrOperand*(arg)
     )
   }
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
index 3fcdc2b88ca7..e2168230b211 100644
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/MissingXMLValidationQuery.qll
@@ -7,6 +7,7 @@ import csharp
 private import semmle.code.csharp.security.dataflow.flowsinks.FlowSinks
 private import semmle.code.csharp.security.dataflow.flowsources.FlowSources
 private import semmle.code.csharp.frameworks.system.Xml
+private import semmle.code.csharp.frameworks.system.IO
 private import semmle.code.csharp.security.Sanitizers
 
 /**
@@ -61,6 +62,51 @@ deprecated class RemoteSource extends DataFlow::Node instanceof RemoteFlowSource
  */
 class ThreatModelSource extends Source instanceof ActiveThreatModelSource { }
 
+private predicate hasUnknownSettingsUse(XmlReaderSettingsCreation creation) {
+  exists(Expr use, Call call |
+    DataFlow::localExprFlow(creation, use) and
+    (
+      use = call.getAnArgument() and
+      not use = call.(XmlReaderCreateCall).getArgumentForName("settings")
+      or
+      use = call.(MethodCall).getQualifier()
+    )
+  )
+  or
+  exists(LocalVariable variable, VariableAccess use |
+    DataFlow::localExprFlow(creation, variable.getAnAccess()) and
+    use = variable.getAnAccess() and
+    use.getEnclosingCallable() != creation.getEnclosingCallable()
+  )
+  or
+  exists(AssignExpr assignment |
+    DataFlow::localExprFlow(creation, assignment.getRightOperand()) and
+    not assignment.getLeftOperand().(VariableAccess).getTarget() instanceof LocalVariable
+  )
+}
+
+private predicate specifiesSchemaValidation(
+  XmlReaderSettingsCreation creation, XmlReaderCreateCall createCall
+) {
+  creation.getValidationType().hasName("Schema") and
+  not exists(Expr value |
+    value = creation.getAValidationTypeValue() and
+    not value = any(SystemXmlValidationType schema | schema.hasName("Schema")).getAnAccess()
+  ) and
+  (
+    not exists(creation.getInitializer())
+    or
+    creation.getEnclosingCallable() = createCall.getEnclosingCallable() and
+    DataFlow::localExprFlow(creation, createCall.getSettings()) and
+    not hasUnknownSettingsUse(creation) and
+    not exists(Expr value |
+      value = creation.getAValidationFlagValue() and
+      not value instanceof BitwiseOrOperation and
+      not value = any(SystemXmlSchemaXmlSchemaValidationFlags flag).getAnAccess()
+    )
+  )
+}
+
 /**
  * The input argument to a call to `XmlReader.Create` where the input will not be validated against
  * a schema.
@@ -85,11 +131,11 @@ class XmlReaderCreateCallSink extends Sink {
     //       internally); or
     //     - The ProcessSchemaLocation option is set (this allows the document to reference a
     //       schema by location that this document will validate against).
-    result = "the 'XmlReaderSettings' instance does not specify the 'ValidationType' as 'Schema'." and
+    result = "the 'XmlReaderSettings' instance is not known to enforce schema validation." and
     exists(XmlReaderSettingsCreation settingsCreation |
       settingsCreation = createCall.getSettings().getASettingsCreation()
     |
-      not settingsCreation.getValidationType().hasName("Schema")
+      not specifiesSchemaValidation(settingsCreation, createCall)
     )
     or
     exists(string badValidationFlag |
@@ -109,3 +155,13 @@ class XmlReaderCreateCallSink extends Sink {
 private class SimpleTypeSanitizer extends Sanitizer, SimpleTypeSanitizedExpr { }
 
 private class GuidSanitizer extends Sanitizer, GuidSanitizedExpr { }
+
+private class NullStreamSanitizer extends Sanitizer {
+  NullStreamSanitizer() {
+    exists(FieldAccess access |
+      this.getExpr() = access and
+      access.getTarget().getDeclaringType() instanceof SystemIOStreamClass and
+      access.getTarget().hasName("Null")
+    )
+  }
+}
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs
index c0615d90bf2b..651ecd588772 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.cs	
@@ -1,5 +1,6 @@
 using System;
 using System.IO;
+using System.Text;
 using System.Web;
 using System.Xml;
 using System.Xml.Schema;
@@ -52,4 +53,125 @@ public bool IsReusable
             return true;
         }
     }
+
+    public void ProcessInitializedSettings(HttpContext ctx)
+    {
+        string xml = ctx.Request.QueryString["xml"]; // $ Source
+        var schemaSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        schemaSettings.Schemas.Add("urn:my-schema", "my.xsd");
+        XmlReader.Create(new StringReader(xml), schemaSettings);
+
+        var inlineSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema,
+            ValidationFlags = XmlSchemaValidationFlags.ProcessInlineSchema
+        };
+        XmlReader.Create(new StringReader(xml), inlineSettings); // $ Alert
+
+        var locationSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema,
+            ValidationFlags = XmlSchemaValidationFlags.ProcessSchemaLocation
+        };
+        XmlReader.Create(new StringReader(xml), locationSettings); // $ Alert
+
+        var resetSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        resetSettings.ValidationType = ValidationType.None;
+        XmlReader.Create(new StringReader(xml), resetSettings); // $ Alert
+
+        var unknownSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        unknownSettings.ValidationType = (ValidationType)int.Parse(ctx.Request.QueryString["type"]);
+        XmlReader.Create(new StringReader(xml), unknownSettings); // $ Alert
+
+        var escapedSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        DisableValidation(escapedSettings);
+        XmlReader.Create(new StringReader(xml), escapedSettings); // $ Alert
+
+        var unknownFlagsSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        unknownFlagsSettings.ValidationFlags =
+            (XmlSchemaValidationFlags)int.Parse(ctx.Request.QueryString["flags"]);
+        XmlReader.Create(new StringReader(xml), unknownFlagsSettings); // $ Alert
+
+        var aliasSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        var alias = aliasSettings;
+        alias.ValidationType = ValidationType.None;
+        XmlReader.Create(new StringReader(xml), aliasSettings); // $ Alert
+
+        var capturedSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        Action reset = () => capturedSettings.ValidationType = ValidationType.None;
+        reset();
+        XmlReader.Create(new StringReader(xml), capturedSettings); // $ Alert
+
+        var storedSettings = new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema
+        };
+        SharedSettings = storedSettings;
+        DisableValidation(SharedSettings);
+        XmlReader.Create(new StringReader(xml), storedSettings); // $ Alert
+
+        var returnedSettings = CreateSettings();
+        DisableValidation(returnedSettings);
+        XmlReader.Create(new StringReader(xml), returnedSettings); // $ Alert
+
+        XmlReader.Create(new StringReader(xml), new XmlReaderSettings
+        {
+            ValidationType = ValidationType.Schema,
+            ValidationFlags = XmlSchemaValidationFlags.ProcessIdentityConstraints |
+                XmlSchemaValidationFlags.AllowXmlAttributes
+        });
+    }
+
+    private static XmlReaderSettings SharedSettings;
+
+    private static XmlReaderSettings CreateSettings()
+    {
+        return new XmlReaderSettings { ValidationType = ValidationType.Schema };
+    }
+
+    private static void DisableValidation(XmlReaderSettings settings)
+    {
+        settings.ValidationType = ValidationType.None;
+    }
+
+    public void ProcessStreams(HttpContext ctx)
+    {
+        var input = new MemoryStream(Encoding.UTF8.GetBytes(ctx.Request.QueryString["xml"])); // $ Source
+        input.CopyTo(Stream.Null);
+        XmlReader.Create(Stream.Null);
+
+        var stream = new MemoryStream();
+        input.CopyTo(stream);
+        stream.Position = 0;
+        XmlReader.Create(stream); // $ Alert
+
+        Streams.Null = new MemoryStream(Encoding.UTF8.GetBytes(ctx.Request.QueryString["otherXml"])); // $ Source
+        XmlReader.Create(Streams.Null); // $ Alert
+    }
+
+    private static class Streams
+    {
+        public static Stream Null;
+    }
 }
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected
index 2477cd600e0f..5740fa01c511 100644
--- a/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected	
+++ b/csharp/ql/test/query-tests/Security Features/CWE-112/MissingXMLValidation.expected	
@@ -1,34 +1,125 @@
 #select
-| MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value |
-| MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance does not specify the 'ValidationType' as 'Schema'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value |
-| MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance does not specify the 'ValidationType' as 'Schema'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value |
-| MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessInlineSchema'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value |
-| MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessSchemaLocation'. | MissingXMLValidation.cs:12:34:12:56 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessInlineSchema'. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessSchemaLocation'. | MissingXMLValidation.cs:13:34:13:56 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessInlineSchema'. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance specifies 'ProcessSchemaLocation'. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | This XML processing depends on a $@ without validation because the 'XmlReaderSettings' instance is not known to enforce schema validation. | MissingXMLValidation.cs:59:22:59:44 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:160:61:160:83 | access to property QueryString | user-provided value |
+| MissingXMLValidation.cs:170:26:170:37 | access to field Null | MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:170:26:170:37 | access to field Null | This XML processing depends on a $@ without validation because there is no 'XmlReaderSettings' instance specifying schema validation. | MissingXMLValidation.cs:169:64:169:86 | access to property QueryString | user-provided value |
 edges
-| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:16:43:16:57 | access to local variable userProvidedXml : String | provenance |  |
-| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:21:43:21:57 | access to local variable userProvidedXml : String | provenance |  |
-| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:27:43:27:57 | access to local variable userProvidedXml : String | provenance |  |
-| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:45:43:45:57 | access to local variable userProvidedXml : String | provenance |  |
-| MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | provenance |  |
-| MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:12:34:12:75 | access to indexer : String | provenance | MaD:1 |
-| MissingXMLValidation.cs:12:34:12:75 | access to indexer : String | MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | provenance |  |
-| MissingXMLValidation.cs:16:43:16:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | provenance | MaD:2 |
-| MissingXMLValidation.cs:21:43:21:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | provenance | MaD:2 |
-| MissingXMLValidation.cs:27:43:27:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | provenance | MaD:2 |
-| MissingXMLValidation.cs:45:43:45:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | provenance | MaD:2 |
+| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:17:43:17:57 | access to local variable userProvidedXml : String | provenance |  |
+| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:22:43:22:57 | access to local variable userProvidedXml : String | provenance |  |
+| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:28:43:28:57 | access to local variable userProvidedXml : String | provenance |  |
+| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:46:43:46:57 | access to local variable userProvidedXml : String | provenance |  |
+| MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | provenance |  |
+| MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:13:34:13:75 | access to indexer : String | provenance | MaD:1 |
+| MissingXMLValidation.cs:13:34:13:75 | access to indexer : String | MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | provenance |  |
+| MissingXMLValidation.cs:17:43:17:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:22:43:22:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:28:43:28:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:46:43:46:57 | access to local variable userProvidedXml : String | MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:72:43:72:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:79:43:79:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:86:43:86:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:93:43:93:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:100:43:100:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:108:43:108:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:116:43:116:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:124:43:124:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:132:43:132:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | MissingXMLValidation.cs:136:43:136:45 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:59:22:59:51 | access to indexer : String | provenance | MaD:1 |
+| MissingXMLValidation.cs:59:22:59:51 | access to indexer : String | MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | provenance |  |
+| MissingXMLValidation.cs:72:43:72:45 | access to local variable xml : String | MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:79:43:79:45 | access to local variable xml : String | MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:86:43:86:45 | access to local variable xml : String | MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:93:43:93:45 | access to local variable xml : String | MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:100:43:100:45 | access to local variable xml : String | MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:108:43:108:45 | access to local variable xml : String | MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:116:43:116:45 | access to local variable xml : String | MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:124:43:124:45 | access to local variable xml : String | MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:132:43:132:45 | access to local variable xml : String | MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:136:43:136:45 | access to local variable xml : String | MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | provenance | MaD:4 |
+| MissingXMLValidation.cs:160:13:160:17 | access to local variable input : MemoryStream | MissingXMLValidation.cs:165:9:165:13 | access to local variable input : MemoryStream | provenance |  |
+| MissingXMLValidation.cs:160:21:160:92 | object creation of type MemoryStream : MemoryStream | MissingXMLValidation.cs:160:13:160:17 | access to local variable input : MemoryStream | provenance |  |
+| MissingXMLValidation.cs:160:38:160:91 | call to method GetBytes : Byte[] | MissingXMLValidation.cs:160:21:160:92 | object creation of type MemoryStream : MemoryStream | provenance | MaD:2 |
+| MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | provenance |  |
+| MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | provenance | MaD:1 |
+| MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | MissingXMLValidation.cs:160:38:160:91 | call to method GetBytes : Byte[] | provenance | MaD:5 |
+| MissingXMLValidation.cs:165:9:165:13 | access to local variable input : MemoryStream | MissingXMLValidation.cs:165:22:165:27 | [post] access to local variable stream : MemoryStream | provenance | MaD:3 |
+| MissingXMLValidation.cs:165:22:165:27 | [post] access to local variable stream : MemoryStream | MissingXMLValidation.cs:166:9:166:14 | access to local variable stream : MemoryStream | provenance |  |
+| MissingXMLValidation.cs:166:9:166:14 | access to local variable stream : MemoryStream | MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | provenance |  |
+| MissingXMLValidation.cs:169:9:169:20 | access to field Null : MemoryStream | MissingXMLValidation.cs:170:26:170:37 | access to field Null | provenance |  |
+| MissingXMLValidation.cs:169:24:169:100 | object creation of type MemoryStream : MemoryStream | MissingXMLValidation.cs:169:9:169:20 | access to field Null : MemoryStream | provenance |  |
+| MissingXMLValidation.cs:169:41:169:99 | call to method GetBytes : Byte[] | MissingXMLValidation.cs:169:24:169:100 | object creation of type MemoryStream : MemoryStream | provenance | MaD:2 |
+| MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | provenance |  |
+| MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | provenance | MaD:1 |
+| MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | MissingXMLValidation.cs:169:41:169:99 | call to method GetBytes : Byte[] | provenance | MaD:5 |
 models
 | 1 | Summary: System.Collections.Specialized; NameValueCollection; false; get_Item; (System.String); ; Argument[this]; ReturnValue; taint; df-generated |
-| 2 | Summary: System.IO; StringReader; false; StringReader; (System.String); ; Argument[0]; Argument[this]; taint; manual |
+| 2 | Summary: System.IO; MemoryStream; false; MemoryStream; (System.Byte[]); ; Argument[0].Element; Argument[this]; taint; manual |
+| 3 | Summary: System.IO; Stream; false; CopyTo; (System.IO.Stream); ; Argument[this]; Argument[0]; taint; manual |
+| 4 | Summary: System.IO; StringReader; false; StringReader; (System.String); ; Argument[0]; Argument[this]; taint; manual |
+| 5 | Summary: System.Text; Encoding; true; GetBytes; (System.String); ; Argument[0]; ReturnValue; taint; manual |
 nodes
-| MissingXMLValidation.cs:12:16:12:30 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
-| MissingXMLValidation.cs:12:34:12:56 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
-| MissingXMLValidation.cs:12:34:12:75 | access to indexer : String | semmle.label | access to indexer : String |
-| MissingXMLValidation.cs:16:26:16:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
-| MissingXMLValidation.cs:16:43:16:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
-| MissingXMLValidation.cs:21:26:21:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
-| MissingXMLValidation.cs:21:43:21:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
-| MissingXMLValidation.cs:27:26:27:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
-| MissingXMLValidation.cs:27:43:27:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
-| MissingXMLValidation.cs:45:26:45:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
-| MissingXMLValidation.cs:45:43:45:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
+| MissingXMLValidation.cs:13:16:13:30 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
+| MissingXMLValidation.cs:13:34:13:56 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| MissingXMLValidation.cs:13:34:13:75 | access to indexer : String | semmle.label | access to indexer : String |
+| MissingXMLValidation.cs:17:26:17:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:17:43:17:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
+| MissingXMLValidation.cs:22:26:22:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:22:43:22:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
+| MissingXMLValidation.cs:28:26:28:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:28:43:28:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
+| MissingXMLValidation.cs:46:26:46:58 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:46:43:46:57 | access to local variable userProvidedXml : String | semmle.label | access to local variable userProvidedXml : String |
+| MissingXMLValidation.cs:59:16:59:18 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:59:22:59:44 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| MissingXMLValidation.cs:59:22:59:51 | access to indexer : String | semmle.label | access to indexer : String |
+| MissingXMLValidation.cs:72:26:72:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:72:43:72:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:79:26:79:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:79:43:79:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:86:26:86:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:86:43:86:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:93:26:93:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:93:43:93:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:100:26:100:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:100:43:100:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:108:26:108:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:108:43:108:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:116:26:116:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:116:43:116:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:124:26:124:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:124:43:124:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:132:26:132:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:132:43:132:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:136:26:136:46 | object creation of type StringReader | semmle.label | object creation of type StringReader |
+| MissingXMLValidation.cs:136:43:136:45 | access to local variable xml : String | semmle.label | access to local variable xml : String |
+| MissingXMLValidation.cs:160:13:160:17 | access to local variable input : MemoryStream | semmle.label | access to local variable input : MemoryStream |
+| MissingXMLValidation.cs:160:21:160:92 | object creation of type MemoryStream : MemoryStream | semmle.label | object creation of type MemoryStream : MemoryStream |
+| MissingXMLValidation.cs:160:38:160:91 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
+| MissingXMLValidation.cs:160:61:160:83 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| MissingXMLValidation.cs:160:61:160:90 | access to indexer : String | semmle.label | access to indexer : String |
+| MissingXMLValidation.cs:165:9:165:13 | access to local variable input : MemoryStream | semmle.label | access to local variable input : MemoryStream |
+| MissingXMLValidation.cs:165:22:165:27 | [post] access to local variable stream : MemoryStream | semmle.label | [post] access to local variable stream : MemoryStream |
+| MissingXMLValidation.cs:166:9:166:14 | access to local variable stream : MemoryStream | semmle.label | access to local variable stream : MemoryStream |
+| MissingXMLValidation.cs:167:26:167:31 | access to local variable stream | semmle.label | access to local variable stream |
+| MissingXMLValidation.cs:169:9:169:20 | access to field Null : MemoryStream | semmle.label | access to field Null : MemoryStream |
+| MissingXMLValidation.cs:169:24:169:100 | object creation of type MemoryStream : MemoryStream | semmle.label | object creation of type MemoryStream : MemoryStream |
+| MissingXMLValidation.cs:169:41:169:99 | call to method GetBytes : Byte[] | semmle.label | call to method GetBytes : Byte[] |
+| MissingXMLValidation.cs:169:64:169:86 | access to property QueryString : NameValueCollection | semmle.label | access to property QueryString : NameValueCollection |
+| MissingXMLValidation.cs:169:64:169:98 | access to indexer : String | semmle.label | access to indexer : String |
+| MissingXMLValidation.cs:170:26:170:37 | access to field Null | semmle.label | access to field Null |
 subpaths