BUG: The CodeAccessPermission.Deny method does not always work as expected (317869)

[C#]
[RegistryPermissionAttribute(SecurityAction.PermitOnly, Read="HKEY_XXX")]
				

MORE INFORMATION

The Help documentation for CodeAccessPermission.Deny that is included in the .NET Framework Developers Guide incorrectly implies that when you use CodeAccessPermission.Deny, there is no way for a user to access the resource.

The following registry example, which is provided in the documentation, allows access as described in the "Steps to Reproduce Behavior" section of this article:

[C#]
using System;
using System.Security.Permissions;

[RegistryPermissionAttribute(SecurityAction.Deny, Write ="HKEY_XXX")]
public class MyClass
{
   public MyClass()
   {    
   }   

   public void ReadRegistry()
   {
      //Access the registry.
   }  
}
				

Steps to Reproduce Behavior

To work around a denial of Read access to the registry key, follow these steps:

1. Create the following string value in the registry:

   Name="HKEY_CURRENT_USER\Security", Value ="SecurityKey"
   					

2. This key is replicated in the registry as follows:

   HKEY_USERS\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXXXX\Security
   					

   For the writer, the key appeared as the following:

   HKEY_USERS\S-1-5-21-124525095-708259637-1543119021-173552\Security
   					

3. Insert the following code in the previous ReadRegistry method (any changes are reflected in both keys):

   [C#]
   using System;
   using System.Security.Permissions;
   using Microsoft.Win32;
   
   [RegistryPermission(SecurityAction.Deny, Read = "HKEY_CURRENT_USER")]
   public class MyClass
   {
   	private static void ReadRegistry()
   	{
   		RegistryKey key = Registry.Users;
   		RegistryKey subkey = key.OpenSubKey(@"S-1-5-21-124525095-708259637-1543119021-173552");
   		string s = subkey.GetValue("security") as string;
   		Console.WriteLine(s);
   	}
   
   }