From 58df1503df489080b4add15a50cd6b9059b65cc3 Mon Sep 17 00:00:00 2001 From: Noah Falk Date: Thu, 12 Jan 2023 17:32:26 -0800 Subject: [PATCH] Fix security transparency issue (#80478) * Remove APTCA None of our assemblies support partial trust usage any longer. Removing the APTCA attribute from S.D.DS so that it follows the pattern. Fixes #79749 * Remove more code for partial trust --- .../Common/src/System/HexConverter.cs | 6 ---- .../src/AssemblyInfo.netfx.cs | 6 ---- ...System.Diagnostics.DiagnosticSource.csproj | 3 +- .../src/System/Diagnostics/Activity.cs | 33 ------------------- .../Diagnostics/ActivityCreationOptions.cs | 16 --------- .../src/System/Diagnostics/Metrics/Counter.cs | 3 -- .../System/Diagnostics/Metrics/Histogram.cs | 3 -- .../System/Diagnostics/Metrics/Instrument.cs | 3 -- .../Diagnostics/Metrics/Instrument.netfx.cs | 3 -- .../System/Diagnostics/Metrics/Measurement.cs | 3 -- .../src/System/Diagnostics/Metrics/Meter.cs | 3 -- .../Diagnostics/Metrics/MeterListener.cs | 3 -- .../Diagnostics/Metrics/ObservableCounter.cs | 3 -- .../Diagnostics/Metrics/ObservableGauge.cs | 3 -- .../Metrics/ObservableInstrument.cs | 6 ---- .../Metrics/ObservableUpDownCounter.cs | 3 -- .../src/System/Diagnostics/Metrics/TagList.cs | 3 -- .../Diagnostics/Metrics/UpDownCounter.cs | 3 -- .../Diagnostics/RandomNumberGenerator.cs | 3 -- 19 files changed, 1 insertion(+), 108 deletions(-) delete mode 100644 src/libraries/System.Diagnostics.DiagnosticSource/src/AssemblyInfo.netfx.cs diff --git a/src/libraries/Common/src/System/HexConverter.cs b/src/libraries/Common/src/System/HexConverter.cs index 51d4647bafa72..fbd5d789c77d8 100644 --- a/src/libraries/Common/src/System/HexConverter.cs +++ b/src/libraries/Common/src/System/HexConverter.cs @@ -76,9 +76,6 @@ public static void ToBytesBuffer(byte value, Span buffer, int startingInde buffer[startingIndex] = (byte)(packedResult >> 8); } -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif [MethodImpl(MethodImplOptions.AggressiveInlining)] public static void ToCharsBuffer(byte value, Span buffer, int startingIndex = 0, Casing casing = Casing.Upper) { @@ -190,9 +187,6 @@ public static void EncodeToUtf16(ReadOnlySpan bytes, Span chars, Cas } } -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public static unsafe string ToString(ReadOnlySpan bytes, Casing casing = Casing.Upper) { #if NETFRAMEWORK || NETSTANDARD2_0 diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/AssemblyInfo.netfx.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/AssemblyInfo.netfx.cs deleted file mode 100644 index 114bc90eee732..0000000000000 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/AssemblyInfo.netfx.cs +++ /dev/null @@ -1,6 +0,0 @@ -// Licensed to the .NET Foundation under one or more agreements. -// The .NET Foundation licenses this file to you under the MIT license. - -using System.Security; - -[assembly: AllowPartiallyTrustedCallers] diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System.Diagnostics.DiagnosticSource.csproj b/src/libraries/System.Diagnostics.DiagnosticSource/src/System.Diagnostics.DiagnosticSource.csproj index 349a9d929d670..db7ca3770e632 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System.Diagnostics.DiagnosticSource.csproj +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System.Diagnostics.DiagnosticSource.csproj @@ -16,7 +16,7 @@ System.Diagnostics.DiagnosticSource - $(DefineConstants);ALLOW_PARTIALLY_TRUSTED_CALLERS;ENABLE_HTTP_HANDLER + $(DefineConstants);ENABLE_HTTP_HANDLER $(DefineConstants);W3C_DEFAULT_ID_FORMAT;MEMORYMARSHAL_SUPPORT;OS_ISBROWSER_SUPPORT true @@ -116,7 +116,6 @@ System.Diagnostics.DiagnosticSource - diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Activity.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Activity.cs index f445dd255e168..581d710fba4ae 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Activity.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Activity.cs @@ -17,9 +17,6 @@ namespace System.Diagnostics /// /// Carries the changed event data. /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public readonly struct ActivityChangedEventArgs { internal ActivityChangedEventArgs(Activity? previous, Activity? current) @@ -219,9 +216,6 @@ public string DisplayName /// public string? Id { -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif get { // if we represented it as a traceId-spanId, convert it to a string. @@ -250,9 +244,6 @@ public string? Id /// public string? ParentId { -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif get { // if we represented it as a traceId-spanId, convert it to a string. @@ -791,9 +782,6 @@ public string? TraceStateString /// public ActivitySpanId SpanId { -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif get { if (_spanId is null) @@ -863,9 +851,6 @@ public ActivityTraceFlags ActivityTraceFlags /// public ActivitySpanId ParentSpanId { -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif get { if (_parentSpanId is null) @@ -971,9 +956,6 @@ private static bool IsW3CId(string id) (id[0] != 'f' || id[1] != 'f'); } -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif internal static bool TryConvertIdToContext(string traceParent, string? traceState, bool isRemote, out ActivityContext context) { context = default; @@ -1279,9 +1261,6 @@ private string AppendSuffix(string parentId, string suffix, char delimiter) } #pragma warning restore CA1822 -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif private static unsafe long GetRandomNumber() { // Use the first 8 bytes of the GUID as a random number. @@ -1300,9 +1279,6 @@ private static bool ValidateSetCurrent(Activity? activity) return canSet; } -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif private bool TrySetTraceIdFromParent() { Debug.Assert(_traceId is null); @@ -1325,9 +1301,6 @@ private bool TrySetTraceIdFromParent() return _traceId != null; } -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif private void TrySetTraceFlagsFromParent() { Debug.Assert(!W3CIdFlagsSet); @@ -1770,9 +1743,6 @@ public enum ActivityIdFormat /// it has to, and caches the string representation after it was created. /// It is mostly useful as an exchange type. /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public readonly struct ActivityTraceId : IEquatable { private readonly string? _hexString; @@ -1954,9 +1924,6 @@ internal static bool IsLowerCaseHexAndNotAllZeros(ReadOnlySpan idData) /// it has to, and caches the string representation after it was created. /// It is mostly useful as an exchange type. /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public readonly struct ActivitySpanId : IEquatable { private readonly string? _hexString; diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/ActivityCreationOptions.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/ActivityCreationOptions.cs index 5deab8f9544f9..5737392650a65 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/ActivityCreationOptions.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/ActivityCreationOptions.cs @@ -114,9 +114,6 @@ internal ActivityCreationOptions(ActivitySource source, string name, T parent, A public ActivityTagsCollection SamplingTags { -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif get { if (_samplerTags == null) @@ -131,9 +128,6 @@ public ActivityTagsCollection SamplingTags public ActivityTraceId TraceId { -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif get { if (Parent is ActivityContext && IdFormat == ActivityIdFormat.W3C && _context == default) @@ -154,14 +148,7 @@ public ActivityTraceId TraceId /// public string? TraceState { -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif get => _traceState; - -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif init { _traceState = value; @@ -169,9 +156,6 @@ public string? TraceState } // SetTraceState is to set the _traceState without the need of copying the whole structure. -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif internal void SetTraceState(string? traceState) => Unsafe.AsRef(in _traceState) = traceState; /// diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Counter.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Counter.cs index 4a8cff4392d65..bb14c06b2c164 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Counter.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Counter.cs @@ -13,9 +13,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public sealed class Counter : Instrument where T : struct { internal Counter(Meter meter, string name, string? unit, string? description) : base(meter, name, unit, description) diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Histogram.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Histogram.cs index f14cd8586e95e..73eeda8c8ac69 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Histogram.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Histogram.cs @@ -13,9 +13,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public sealed class Histogram : Instrument where T : struct { internal Histogram(Meter meter, string name, string? unit, string? description) : base(meter, name, unit, description) diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.cs index 4d16ef4bb9947..8d86704500666 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.cs @@ -8,9 +8,6 @@ namespace System.Diagnostics.Metrics /// /// Base class of all Metrics Instrument classes /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public abstract class Instrument { internal static KeyValuePair[] EmptyTags => Array.Empty>(); diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.netfx.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.netfx.cs index 990735f023ee5..f04dc0d9d11d8 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.netfx.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Instrument.netfx.cs @@ -12,9 +12,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public abstract partial class Instrument : Instrument where T : struct { [ThreadStatic] diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Measurement.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Measurement.cs index 00b398503fa81..49db3c86f8dbf 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Measurement.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Measurement.cs @@ -9,9 +9,6 @@ namespace System.Diagnostics.Metrics /// Measurement stores one observed metrics value and its associated tags. This type is used by Observable instruments' Observe() method when reporting current measurements. /// with the associated tags. /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public readonly struct Measurement where T : struct { private readonly KeyValuePair[] _tags; diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Meter.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Meter.cs index 8332e5de79d8e..431272393a0d3 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Meter.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/Meter.cs @@ -10,9 +10,6 @@ namespace System.Diagnostics.Metrics /// /// Meter is the class responsible for creating and tracking the Instruments. /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public class Meter : IDisposable { private static readonly List s_allMeters = new List(); diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/MeterListener.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/MeterListener.cs index 165b31371a8e0..6c3d38f0b6aea 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/MeterListener.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/MeterListener.cs @@ -14,9 +14,6 @@ namespace System.Diagnostics.Metrics /// /// MeterListener is class used to listen to the metrics instrument measurements recording. /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public sealed class MeterListener : IDisposable { // We use LikedList here so we don't have to take any lock while iterating over the list as we always hold on a node which be either valid or null. diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableCounter.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableCounter.cs index 4a360a2508213..651b4f5b6e351 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableCounter.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableCounter.cs @@ -13,9 +13,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public sealed class ObservableCounter : ObservableInstrument where T : struct { private object _callback; diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableGauge.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableGauge.cs index f73845a114844..6e659a56d68a0 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableGauge.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableGauge.cs @@ -13,9 +13,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public sealed class ObservableGauge : ObservableInstrument where T : struct { private object _callback; diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableInstrument.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableInstrument.cs index 7e76ac3bd264c..79cc57314a8e9 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableInstrument.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableInstrument.cs @@ -12,9 +12,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public abstract class ObservableInstrument : Instrument where T : struct { /// @@ -41,9 +38,6 @@ protected ObservableInstrument(Meter meter, string name, string? unit, string? d public override bool IsObservable => true; // Will be called from MeterListener.RecordObservableInstruments for each observable instrument. -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif internal override void Observe(MeterListener listener) { object? state = GetSubscriptionState(listener); diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableUpDownCounter.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableUpDownCounter.cs index 32ea7255ba406..1589930bdbc25 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableUpDownCounter.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/ObservableUpDownCounter.cs @@ -13,9 +13,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public sealed class ObservableUpDownCounter : ObservableInstrument where T : struct { private object _callback; diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/TagList.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/TagList.cs index bc1d02525895a..159f74338fc4d 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/TagList.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/TagList.cs @@ -24,9 +24,6 @@ namespace System.Diagnostics /// Using more than eight tags will cause allocating memory to store the tags. /// Public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe. /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif [StructLayout(LayoutKind.Sequential)] public struct TagList : IList>, IReadOnlyList> { diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/UpDownCounter.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/UpDownCounter.cs index 88a11cd12851d..8a908e9d66595 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/UpDownCounter.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/Metrics/UpDownCounter.cs @@ -12,9 +12,6 @@ namespace System.Diagnostics.Metrics /// /// This class supports only the following generic parameter types: , , , , , , and /// -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public sealed class UpDownCounter : Instrument where T : struct { internal UpDownCounter(Meter meter, string name, string? unit, string? description) : base(meter, name, unit, description) diff --git a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/RandomNumberGenerator.cs b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/RandomNumberGenerator.cs index dfb8c50bb7499..351e8ce6ad7e7 100644 --- a/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/RandomNumberGenerator.cs +++ b/src/libraries/System.Diagnostics.DiagnosticSource/src/System/Diagnostics/RandomNumberGenerator.cs @@ -14,9 +14,6 @@ internal sealed class RandomNumberGenerator public static RandomNumberGenerator Current => t_random ??= new RandomNumberGenerator(); -#if ALLOW_PARTIALLY_TRUSTED_CALLERS - [System.Security.SecuritySafeCriticalAttribute] -#endif public unsafe RandomNumberGenerator() { do