Fix security transparency issue

[noahfalk]

Fixes#79749

[UPDATE]: The new fix is to remove the APTCA attribute and avoid running in partial trust.

[ORIGINAL fix that is no longer being applied]
This is a partial revert of #78729. That change inadvertently introduced a security transparency issue because the newly added AsSpan() call is security critical and can't be called in a security transparent scope.

[stephentoub]

Why is AsSpan security critical, and why doesn't this impact every other netstandard2.0 library we have that uses AsSpan? Why is this test running in partial trust yet no other tests seem to be?

[jkotas]

We have removed .NET Framework partial trust support long time ago. It is not possible to use any new language features for .NET Framework partial trust. Details are in #24122.

Why does the test from #79749 run in a partial trust sandbox?

[noahfalk]

Why does the test from #79749 run in a partial trust sandbox?

Unknown. It isn't an intentional aspect of the tests for this assembly that it should run under partial trust. I assumed that partial trust was simply a test environment that was occasionally used and I had no desire for these tests to generate spurious failures if they were going to be subjected to that.

why doesn't this impact every other netstandard2.0 library we have that uses AsSpan?

Perhaps because System.Diagnostics.DiagnosticSource has a lingering APTCA attribute and other libraries don't?

runtime/src/libraries/System.Diagnostics.DiagnosticSource/src/AssemblyInfo.netfx.cs

Line 6 in 57bfe47

[assembly:AllowPartiallyTrustedCallers]

I am unaware of what scenario requires S.D.DS to maintain the APTCA attribute so I am fine to remove it. It sounds like that would align this assembly with general approach used by the rest of our libraries?

[stephentoub]

Perhaps because System.Diagnostics.DiagnosticSource has a lingering APTCA attribute and other libraries don't?

Got it. Yeah, it appears to be the only one left. (We also seem to have one test that sets it, but no other production assemblies.)

so I am fine to remove it

That sounds like the right solution to me.

[jkotas]

I am unaware of what scenario requires S.D.DS to maintain the APTCA attribute

FWIW, the APTCA attribute was introduced by dotnet/corefx#17076 .

[jkotas]

Could you please also delete ALLOW_PARTIALLY_TRUSTED_CALLERS from src\libraries\Common\src\System\HexConverter.cs?

LGTM otherwise.

[noahfalk]

Sure, got HexConverter.cs as well.

[stephentoub]

It'd still be interesting to know why the tests are running in partial trust. @ViktorHofer, do you know?

[jkotas]

I do not think that the tests are running in partial trust.

.NET Framework validates consistency of the SecurityCritical/SecurityTransparent attributes in APTCA assemblies even when the code is running in full trust. It explains why the test is failing.

[stephentoub]

even when the code is running in full trust

Interesting, I didn't know that. Thanks.