[Copilot]

ilverify only honored InternalsVisibleToAttribute for cross-assembly access checks, so IL that legitimately accesses another assembly's internal/private members via [assembly: IgnoresAccessChecksTo("...")] was incorrectly reported as invalid. This aligns ilverify with CoreCLR runtime behavior, where an assembly declaring IgnoresAccessChecksTo may bypass all access checks (private, family, assembly) to the named target — stronger than InternalsVisibleTo.

Changes

• AccessVerificationHelpers.cs

  • Added IgnoresAccessChecksTo(this ModuleDesc accessing, ModuleDesc accessed) which decodes System.Runtime.CompilerServices.IgnoresAccessChecksToAttribute on the accessing assembly and matches the accessed assembly by simple name — mirroring the runtime's FriendAssemblyDescriptor::IsAssemblyOnList / RefMatchesDef (name-only match when the declared name omits a public key token).
  • Added a bypass in the type-level CanAccess (after the generic-instantiation checks, so third-assembly instantiation arguments are still validated) and in CanAccessMember, covering type, method, and field access.

• Tests — new AccessTestsIgnoreChecks.il / .ilproj test assembly declaring [IgnoresAccessChecksTo("AccessTests")] (defining the attribute type itself, as real consumers like IgnoresAccessChecksToGenerator do), with 11 cases exercising private/family/assembly classes, nested types, methods, and fields. Confirmed the cases fail without the fix and pass with it.

// Accessing assembly waives all access checks to the target assembly.
if (currentTypeDef.Module.IgnoresAccessChecksTo(targetTypeDef.Module))
    return true;

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[MichalPetryka]

The test can be in C# but using separate ref and impl assemblies differing by member accessibility, it might be cleaner that way.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @dotnet/jit-contrib
See info in area-owners.md if you want to be subscribed.

[jkotas]

This is very rare case - check of last resort, and it is somewhat expensive due to custom attribute lookup and parsing. It should be done last when all other ways to prove accessibility failed.

[MichalPetryka]

Does ILVerify performance matter to this extent? I'd have assumed the overhead to be fine enough for it.

[jkotas]

It is also about matching the runtime behavior. Runtime checks both IgnoresAccessChecksTo and InternalsVisibleTo attributes last. It is not obvious that checking this attribute first is going to match the runtime behavior in all cases.

[dotnet-policy-service]

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.