CodeDom: Runtime code evaluation and system security

[balabaster]

I don't know if anyone's got any clue about this, but I have the following expression evaluator which makes use of the CodeDom to evaluate a VB.NET expression at runtime.

This gives the system administrator the ability to add ad-hoc expressions onto the system, and when users execute these expressions, they are prompted for data for the arguments.

Function Evaluate(ByVal Expression As String, ByVal Args() As Object) As Double
 
        If Expression.Length > 0 Then
 
            'Replace each parameter in the calculation expression with the correct values
            Dim MatchStr = "{(\d+)}"
            Dim oMatches = Regex.Matches(Expression, MatchStr)
            Dim DistinctCount = (From m In oMatches _
                                 Select m.Value).Distinct.Count
            If DistinctCount = Args.Length Then
                For i = 0 To Args.Length - 1
                    Expression = Expression.Replace("{" & i & "}", Args(i))
                Next
            Else
                Console.WriteLine("Invalid number of parameters passed")
            End If
 
            Dim FuncName As String = "Eval" & Guid.NewGuid.ToString("N")
            Dim FuncString As String = "Imports System.Math" & vbCrLf & _
                                       "Namespace EvaluatorLibrary" & vbCrLf & _
                                       "  Class Evaluators" & vbCrLf & _
                                       "    Public Shared Function " & FuncName & "() As Double" & vbCrLf & _
                                       "      " & Expression & vbCrLf & _
                                       "    End Function" & vbCrLf & _
                                       "  End Class" & vbCrLf & _
                                       "End Namespace"
 
            'Tell the compiler what language was used
            Dim CodeProvider As CodeDomProvider = CodeDomProvider.CreateProvider("VB")
 
            'Set up our compiler options...
            Dim CompilerOptions As New CompilerParameters()
            With CompilerOptions
                .ReferencedAssemblies.Add("System.dll")
                .GenerateInMemory = True
                .TreatWarningsAsErrors = True
            End With
 
            'Compile the code that is to be evaluated
            Dim Results As CompilerResults = _
                CodeProvider.CompileAssemblyFromSource(CompilerOptions, FuncString)
 
            'Check there were no errors...
            If Results.Errors.Count > 0 Then
            Else
                'Run the code and return the value...
                Dim dynamicType As Type = Results.CompiledAssembly.GetType("EvaluatorLibrary.Evaluators")
                Dim methodInfo As MethodInfo = dynamicType.GetMethod(FuncName)
                Return methodInfo.Invoke(Nothing, Nothing)
            End If
 
        Else
            Return 0
 
        End If
 
    End Function

This can be called using something like:

Dim Expr As String = "  If ({0} < 20000) Then" & vbCrLf & _
                     "    Return MAX(15, MIN(75,0.12*{0}))" & vbCrLf & _
                     "  Else" & vbCrLf & _
                     "    Return MAX(75,0.05*{0})" & vbCrLf & _
                     "  End If"
Dim Args() As Object = New Object() {2300}
Dim dblOut = Evaluate(Expr, Args)
Console.WriteLine(dblOut)
Console.ReadLine()

The expression could equally be extracted from the text of a RichTextBox.

Now, I'm looking at running this code on a web server, and as such, security is going to be an issue (not that I want to come across as not trusting the system administrators, but you never know what the future brings). While this code may be running in isolated memory space, it's not prevented from reading and writing to the system. Is there any way to lock it down to prevent someone from adding potentially insecure references?