How to create an empty compilation with roslyn where ExternalReferences of the Microsoft.CodeAnalysis.Compilation collection is empty, (no mscorlib)

[kasajian]

Is there a way to create a roslyn script using the CSharpScript.Create API such that the script will not have an automatic reference to mscorlib?

Even when I attempt to pass in options overriding the defaults with WithReferences and WithMetadataResolver, OR using a custom MetadataReferenceResolver whose ResolveMissingAssemblies property returns false, and the overridden methods do nothing, even after all that, when I create the Microsoft.CodeAnalysis.Scripting.Script object, subsequently calling the GetCompilation() method on it results in getting Microsoft.CodeAnalysis.Compilation object that has non-empty ExternalReferences property, i.e. mscorelib.dll is in the list.

Literally, the roslyn API is automatically including mscorelib dll when the MetadataReferenceResolver is not configured to not resolve any assemblies. The question is on how to create a compilation object that has an empty set of references rather than the default set.

[333fred]

No, there is no way to do this. Scripting needs to be able to create scripts that can run in the current process: that means agreeing on things like "where object lives". That means depending on mscorlib (or System.Private.Corelib in modern .NET). If you're looking to depend on a different core library, scripting is not the API you are looking for.

[kasajian]

What I'm looking to do is to prevent users from access the file system by directly accessing the namespace. file-system is an example.
mscorlib does a lot, so i guess that won't work.

[333fred]

Scripting is not an appropriate sandbox for this type of protection. If you need real security boundaries, use a technology that actually provides guarantees, such as containerization.

[kasajian]

This is for a desktop application. For performance reasons, it needs to be in-process. We'll have to go with javascript or lua or something like that.