// static default constructor. This will be called before any of the static members are accessed.
        static CodeAccessSecurityEngine()
        {
#pragma warning disable 618
            AssertPermission = new SecurityPermission(SecurityPermissionFlag.Assertion);
#pragma warning restore 618
            AssertPermissionToken = PermissionToken.GetToken(AssertPermission);
        }

 [System.Security.SecurityCritical]  // auto-generated
 private static bool FrameDescHelper(FrameSecurityDescriptor secDesc,
                                        IPermission demandIn, 
                                        PermissionToken permToken,
                                        RuntimeMethodHandleInternal rmh)
 {
     return secDesc.CheckDemand((CodeAccessPermission) demandIn, permToken, rmh);
 }

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandle rmh)
 {
     this.CompleteConstruction(null);
     if (this.PLS != null)
     {
         this.PLS.CheckDemand(demand, permToken, rmh);
     }
     return false;
 }

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh)
 {
     if (!CheckAssert(this.AssertSet, demand, permToken))
     {
         return false;
     }
     CodeAccessSecurityEngine.CheckHelper(this.GrantSet, this.RefusedSet, demand, permToken, rmh, null, SecurityAction.Demand, true);
     return true;
 }

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh)
 {
     bool flag = this.CheckDemand2(demand, permToken, rmh, false);
     if (flag)
     {
         flag = this.CheckDemand2(demand, permToken, rmh, true);
     }
     return flag;
 }

 internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh)
 {
     bool flag = true;
     if (this.m_permSetTriples != null)
     {
         for (int i = 0; (i < this.m_permSetTriples.Count) && flag; i++)
         {
             flag = ((PermissionSetTriple) this.m_permSetTriples[i]).CheckDemand(demand, permToken, rmh);
         }
     }
     else if (this.m_firstPermSetTriple != null)
     {
         flag = this.m_firstPermSetTriple.CheckDemand(demand, permToken, rmh);
     }
     return false;
 }

 private static bool CheckAssert(PermissionSet pSet, CodeAccessPermission demand, PermissionToken permToken)
 {
     if (pSet != null)
     {
         pSet.CheckDecoded(demand, permToken);
         CodeAccessPermission asserted = (CodeAccessPermission) pSet.GetPermission(demand);
         try
         {
             if (pSet.IsUnrestricted() || demand.CheckAssert(asserted))
             {
                 return false;
             }
         }
         catch (ArgumentException)
         {
         }
     }
     return true;
 }

        internal bool CheckDemandInternal(CodeAccessPermission demand, PermissionToken permToken, out Exception exception)
        {
            BCLDebug.Assert(demand != null, "demand != null");
            BCLDebug.Assert(permToken != null, "permToken != null");
            
            // First, find if there is a permission list of this type.

            PermissionList permList = FindPermissionList(permToken);
                
            if (permList != null)
            {
                // If so, check against it to determine our action.

                bool cont = permList.CheckDemandInternal(demand, out exception);

                // We don't record modifiers for the unrestricted permission set in the
                // individual lists.  Therefore, permList.CheckDemandInternal may say
                // that we have to continue the stackwalk, but we know better.

                if (cont && permToken.m_isUnrestricted)
                {
                    if ((m_state & PermissionListSetState.UnrestrictedDeny) != 0)
                    {
                        exception = new SecurityException(String.Format( Environment.GetResourceString("Security_Generic"), demand.GetType().AssemblyQualifiedName ) );
                        return false;
                    }
                    else
                    {
                        cont = cont && ((m_state & PermissionListSetState.UnrestrictedAssert) == 0);
                    }
                }

                return cont;
            }
#if _DEBUG
            // Let's check to make sure we always pass demands for empty permissions.

            else if (demand.IsSubsetOf( null ))
            {
                BCLDebug.Assert( false, "We should pick of empty demands before this point" );
                exception = null;
                return true;
            }
#endif
            // If the permission is not unrestricted, the lack of a permission list
            // denotes that no frame on the stack granted this permission, and therefore
            // we pass back the failure condition.

            else if (!permToken.m_isUnrestricted)
            {
                exception = new SecurityException(String.Format( Environment.GetResourceString("Security_Generic"), demand.GetType().AssemblyQualifiedName ) );
                return false;
            }

            // If this permission list set is not unrestricted and there is no unrestricted assert
            // then the lack of a permission list denotes that no frame on the stack granted
            // this permission, and therefore we pass back the failure condition.  If there is
            // an unrestricted assert, then we pass back success and terminate the stack walk.

            else if (!this.IsUnrestricted())
            {
                exception = new SecurityException(String.Format( Environment.GetResourceString("Security_Generic"), demand.GetType().AssemblyQualifiedName ) );
                return false;
            }
            
            // If we made it all the way through, that means that we are in the unrestricted
            // state and that this permission is encompassed in that.  If we have an unrestricted
            // assert, we are done with the state walk (return false), otherwise keep going.

            exception = null;
            return (m_state & PermissionListSetState.UnrestrictedAssert) == 0;
        }

        internal bool CheckDemand(CodeAccessPermission demand, PermissionToken permToken)
        {
            Exception exception;

            bool cont = CheckDemandInternal( demand, permToken, out exception );

            if (exception != null)
            {
                throw exception;
            }

            return cont;
        }

 internal PermissionList FindPermissionList(PermissionToken permToken)
 {
     BCLDebug.Assert(permToken != null, "permToken != null");
     
     return FindPermissionList(permToken.m_index, permToken.m_isUnrestricted);
 }

 private PermissionList GetListForToken(PermissionToken permToken, bool create)
 {
     TokenBasedSet permSet;
     
     BCLDebug.Assert(permToken != null, "permToken != null");
     
     if (permToken.m_isUnrestricted)
         permSet = m_unrestrictedPermSet;
     else
         permSet = m_normalPermSet;
     
     PermissionList plist = (PermissionList)permSet.GetItem(permToken.m_index);
     if (plist == null && create)
     {
         plist = new PermissionList();
         permSet.SetItem(permToken.m_index, plist);
     }
     
     return plist;
 }

        [System.Security.SecurityCritical]  // auto-generated
        internal bool CheckDemand2(CodeAccessPermission demand, PermissionToken permToken, RuntimeMethodHandleInternal rmh, bool fDeclarative)
        {
            PermissionSet permSet;
            
            // If the demand is null, there is no need to continue
            Contract.Assert(demand != null && !demand.CheckDemand(null), "Empty demands should have been filtered out by this point");

            // decode imperative
            if (GetPermitOnly(fDeclarative) != null)
                GetPermitOnly(fDeclarative).CheckDecoded(demand, permToken);
    
            if (GetDenials(fDeclarative) != null)
                GetDenials(fDeclarative).CheckDecoded(demand, permToken);
    
            if (GetAssertions(fDeclarative) != null)
                GetAssertions(fDeclarative).CheckDecoded(demand, permToken);
            
            // NOTE: See notes about exceptions and exception handling in FrameDescSetHelper 
    
            bool bThreadSecurity = SecurityManager._SetThreadSecurity(false);
    
            // Check Reduction
            
            try
            {
                permSet = GetPermitOnly(fDeclarative);
                if (permSet != null)
                {
                    CodeAccessPermission perm = (CodeAccessPermission)permSet.GetPermission(demand);
            
                    // If the permit only set does not contain the demanded permission, throw a security exception
                    if (perm == null)
                    {
                        if (!permSet.IsUnrestricted())
                            throw new SecurityException(String.Format(CultureInfo.InvariantCulture, Environment.GetResourceString("Security_Generic"), demand.GetType().AssemblyQualifiedName), null, permSet, SecurityRuntime.GetMethodInfo(rmh), demand, demand);
                    }
                    else
                    {
                        bool bNeedToThrow = true;
    
                        try
                        {
                            bNeedToThrow = !demand.CheckPermitOnly(perm);
                        }
                        catch (ArgumentException)
                        {
                        }
    
                        if (bNeedToThrow)
                            throw new SecurityException(String.Format(CultureInfo.InvariantCulture, Environment.GetResourceString("Security_Generic"), demand.GetType().AssemblyQualifiedName), null, permSet, SecurityRuntime.GetMethodInfo(rmh), demand, demand);
                    }
                }
            
                // Check Denials
            
                permSet = GetDenials(fDeclarative);
                if (permSet != null)
                {
                    CodeAccessPermission perm = (CodeAccessPermission)permSet.GetPermission(demand);
                    
                    // If an unrestricted set was denied and the demand implements IUnrestricted
                    if (permSet.IsUnrestricted())
                        throw new SecurityException(String.Format(CultureInfo.InvariantCulture, Environment.GetResourceString("Security_Generic"), demand.GetType().AssemblyQualifiedName), permSet, null, SecurityRuntime.GetMethodInfo(rmh), demand, demand);
    
                    // If the deny set does contain the demanded permission, throw a security exception
                    bool bNeedToThrow = true;
                    try
                    {
                        bNeedToThrow = !demand.CheckDeny(perm);
                    }
                    catch (ArgumentException)
                    {
                    }
                    if (bNeedToThrow)
                        throw new SecurityException(String.Format(CultureInfo.InvariantCulture, Environment.GetResourceString("Security_Generic"), demand.GetType().AssemblyQualifiedName), permSet, null, SecurityRuntime.GetMethodInfo(rmh), demand, demand);
                }
    
                if (GetAssertAllPossible())
                {
                    return SecurityRuntime.StackHalt;
                }        
    
                permSet = GetAssertions(fDeclarative);
                // Check Assertions
                if (permSet != null)
                {
            
                    CodeAccessPermission perm = (CodeAccessPermission)permSet.GetPermission(demand);
                
                    // If the assert set does contain the demanded permission, halt the stackwalk
            
                    try
                    {
                        if (permSet.IsUnrestricted() || demand.CheckAssert(perm))
                        {
                            return SecurityRuntime.StackHalt;
                        }
                    }
                    catch (ArgumentException)
//.........这里部分代码省略.........

        [System.Security.SecurityCritical]  // auto-generated
        internal bool CheckDemandNoThrow(CodeAccessPermission demand, PermissionToken permToken)
        {
            Contract.Assert(AssertSet == null, "AssertSet not null");
#pragma warning disable 618
            return CodeAccessSecurityEngine.CheckHelper(GrantSet, RefusedSet, demand, permToken, RuntimeMethodHandleInternal.EmptyHandle, null, SecurityAction.Demand, false);
#pragma warning restore 618
        }

        [System.Security.SecurityCritical] // auto-generated
        #endif
#pragma warning disable 618
        internal static void CheckHelper(Object notUsed,
#pragma warning restore 618
                                        PermissionSet grantedSet,
                                        PermissionSet refusedSet,
                                        CodeAccessPermission demand, 
                                        PermissionToken permToken,
                                        RuntimeMethodHandleInternal rmh,
                                        RuntimeAssembly asm,
                                        SecurityAction action)
        {
            // To reduce the amount of ifdef-code-churn, a dummy arg is used for the first parameter - instead of a CompressedStack object,
            // we use a System.Object that should always be null. If we tried to change the signature of the function, there will need to be
            // corresponding changes in VM (metasig.h, mscorlib.h, securitystackwalk.cpp, number of elements in the arg array, etc.)
            Contract.Assert(notUsed == null, "Should not reach here with a non-null first arg which is the CompressedStack");
            CheckHelper(grantedSet, refusedSet, demand, permToken, rmh, (Object)asm, action, true);
        }

 private static object Deserialize(byte[] blob)
 {
     if (blob == null)
     {
         return null;
     }
     if (blob[0] == 0)
     {
         SecurityElement topElement = new Parser(blob, Tokenizer.ByteTokenEncoding.UTF8Tokens, 1).GetTopElement();
         if (topElement.Tag.Equals("IPermission") || topElement.Tag.Equals("Permission"))
         {
             IPermission permission = XMLUtil.CreatePermission(topElement, PermissionState.None, false);
             if (permission == null)
             {
                 return null;
             }
             permission.FromXml(topElement);
             return permission;
         }
         if (topElement.Tag.Equals("PermissionSet"))
         {
             PermissionSet set = new PermissionSet();
             set.FromXml(topElement, false, false);
             return set;
         }
         if (topElement.Tag.Equals("PermissionToken"))
         {
             PermissionToken token = new PermissionToken();
             token.FromXml(topElement);
             return token;
         }
         return null;
     }
     using (MemoryStream stream = new MemoryStream(blob, 1, blob.Length - 1))
     {
         return CrossAppDomainSerializer.DeserializeObject(stream);
     }
 }

        internal PermissionToken BuiltInGetToken( int index, IPermission perm, Type cls )
        {
            PermissionToken token = Volatile.Read(ref m_builtIn[index]);

            if (token == null)
            {
                lock (this)
                {
                    token = m_builtIn[index];

                    if (token == null)
                    {
                        PermissionTokenType permType = PermissionTokenType.DontKnow;

                        if (perm != null)
                        {
                            permType = PermissionTokenType.IUnrestricted;
                        }
                        else if (cls != null)
                        {
                            permType = PermissionTokenType.IUnrestricted;
                        }

                        token = new PermissionToken( index, permType | PermissionTokenType.BuiltIn, null );
                        Volatile.Write(ref m_builtIn[index], token);
                        PermissionToken.s_tokenSet.SetItem( token.m_index, token );
                    }
                }
            }

            if ((token.m_type & PermissionTokenType.DontKnow) != 0)
            {
                    token.m_type = PermissionTokenType.BuiltIn;

                    if (perm != null)
                    {
                        token.m_type |= PermissionTokenType.IUnrestricted;
                    }
                    else if (cls != null)
                    {
                        token.m_type |= PermissionTokenType.IUnrestricted;
                    }
                    else
                    {
                        token.m_type |= PermissionTokenType.DontKnow;
                    }
            }

            return token;
        }

        internal PermissionToken GetToken(String typeStr)
        {
            Object tok = null;
            tok = m_tokenTable != null ? m_tokenTable[typeStr] : null; // Assumes asynchronous lookups are safe
            if (tok == null)
            {
                lock (this)
                {
                    if (m_tokenTable != null)
                    {
                        tok = m_tokenTable[typeStr]; // Make sure it wasn't just added
                    }
                    else
                        m_tokenTable = new Hashtable(m_size, 1.0f, new PermissionTokenKeyComparer());
                        
                    if (tok == null)
                    {
                        tok = new PermissionToken( m_index++, PermissionTokenType.DontKnow, typeStr );
                        m_tokenTable.Add(typeStr, tok);
                        m_indexTable.Add(m_index - 1, tok);
                        PermissionToken.s_tokenSet.SetItem(((PermissionToken)tok).m_index, tok);
                    }
                }
            }

            return (PermissionToken)tok;
        }

        public static bool IsTokenProperlyAssigned( IPermission perm, PermissionToken token )
        {
            PermissionToken heldToken = GetToken( perm );
            if (heldToken.m_index != token.m_index)
                return false;

            if (token.m_type != heldToken.m_type)
                return false;

            if (perm.GetType().Module.Assembly == Assembly.GetExecutingAssembly() &&
                heldToken.m_index >= BuiltInPermissionIndex.NUM_BUILTIN_NORMAL + BuiltInPermissionIndex.NUM_BUILTIN_UNRESTRICTED)
                return false;

            return true;
        }

        internal bool CheckDemandNoThrow(CodeAccessPermission demand, PermissionToken permToken)
        {
            Exception exception;

            CheckDemandInternal( demand, permToken, out exception );

            return (exception == null);
        }

 internal void GetZoneAndOrigin(ArrayList zoneList, ArrayList originList, PermissionToken zoneToken, PermissionToken originToken) 
 {
     if (m_zoneList != null)
         zoneList.AddRange(m_zoneList);
     if (m_originList != null) 
         originList.AddRange(m_originList);
 }