如何使用Reflection避免访问类的私有成员？

Question

I was reading Security Considerations for Reflection and I saw the following line:

Transparent code cannot use reflection to access security-critical members, even if the code is fully trusted. A MethodAccessException, FieldAccessException, or TypeAccessException is thrown.

So, I've written a test program:

Class Library:

namespace ClassLibrary
{
    public class Foo
    {
        [SecurityCritical] private int X;
    }
}

Test program:

using ClassLibrary;
namespace ReflectionSecurityTest
{
    class Program
    {
        static void Main(string[] args)
        {
            Foo f = new Foo();
            var flags = BindingFlags.Instance | BindingFlags.NonPublic;
            var field = f.GetType().GetField("X", flags);
            field.SetValue(f,15);
            Console.WriteLine(field.GetValue(f));
        }
    }
}

I would expect to see an exception but instead I see 15 in the Console.The question is why ? Did I misunderstand what SecurityCritical does or did I do something wrong?

Answer 1

The bullet point below that states:

• Code that is running with partial trust is treated as transparent.

Application code that is run from the command line runs with full trust. As long as it is not marked as transparent, it can use reflection to access security-critical members. When the same code is run with partial trust (for example, in a sandboxed application domain) the assembly's trust level determines whether it can access security-critical code: If the assembly has a strong name and is installed in the global assembly cache, it is a trusted assembly and can call security-critical members. If it is not trusted, it becomes transparent even though it was not marked as transparent, and it cannot access security-critical members.

So to answer the question from your title:

How can I avoid accessing private members of a class using Reflection?

You can't, if you can't sandbox the code performing the reflection.