razorengine - ASP.NET Razor templates editable by users - remove @ for security reasons -

i made multi-user blog engine uses great asp.net razor template engine.

users able edit page templates , compose them custom tags {{blog_post_name}} {{blog_post_comments_list}}

then tags {{...}} replaced using regex appropriate razor code.

all usage of razor syntax done inside {{...}} custom tags not editable users.

so user can edit blog post templates beside custom {{...}} tags composed from.

what way restrict razor syntax in user defined templates?

i don't want user @(viewmodel.db.dropalltables()) inside template of blog post, must have access @(something...) inside tags not editable users.

as now, before user saves template remove @ user edited template , replace tags razor content.

but users can @viewmodel.something , still calls razor logic...

i'm thinking of removing @ symbols user template prevent it, not allow user css @media-queries , use email@addresses.com in template.

last thing did - changed regex finds symbols delete user templates (@+\b)|(\b@+\b)

that regex finds @ remove from: '@abc '@' @abc bcd@ abc@(for)

but keeps for: abc@abc

maybe forgot other possible usages of razor @

what can suggest in order have user-defined templates secured , allow razor syntax used inside tag content only?

update: razorengine used.

do use asp.net or razorengine? applied both tags questions i'm assuming using razorengine , answer question:

i suggest allow , apply runtime restrictions via code-access-security , isolated appdomain (this still has drawbacks: users can occupy resources, fix require process level isolation). can use razorengine isolation api this: https://antaris.github.io/razorengine/isolation.html

in case of asp.net can same, on own , need take care of cross-domain communication yourself.

matthid - razorengine contributor