Fix code injection in C# and ASP.NET Core

public double Evaluate(string formula, QuoteRow row) =>
    CSharpScript.EvaluateAsync<double>(formula, Options, globals: row).GetAwaiter().GetResult();

public double Evaluate(string formula, QuoteRow row) => new Parser(formula, row).Parse();

private sealed class Parser
{
    private static readonly HashSet<string> Fields = new() { "price", "quantity", "discount" };
    private readonly string _src;
    private readonly QuoteRow _row;
    private int _pos;
    private string? _token;

    public Parser(string src, QuoteRow row)
    {
        _src = src;
        _row = row;
        Next();
    }

    public double Parse()
    {
        double value = Expr();
        if (_token is not null) throw new FormatException($"unexpected token \"{_token}\"");
        return value;
    }

    // The next number, name, operator or parenthesis, or null at the end.
    private void Next()
    {
        while (_pos < _src.Length && char.IsWhiteSpace(_src[_pos])) _pos++;
        if (_pos >= _src.Length) { _token = null; return; }
        char c = _src[_pos];
        if (char.IsDigit(c) || c == '.')
        {
            int start = _pos;
            while (_pos < _src.Length && (char.IsDigit(_src[_pos]) || _src[_pos] == '.')) _pos++;
            _token = _src[start.._pos];
        }
        else if (char.IsLetter(c) || c == '_')
        {
            int start = _pos;
            while (_pos < _src.Length && (char.IsLetterOrDigit(_src[_pos]) || _src[_pos] == '_')) _pos++;
            _token = _src[start.._pos];
        }
        else if ("+-*/()".IndexOf(c) >= 0) { _token = c.ToString(); _pos++; }
        else throw new FormatException($"unexpected character '{c}'");
    }

    // expr := term (('+' | '-') term)*
    private double Expr()
    {
        double value = Term();
        while (_token is "+" or "-")
        {
            string op = _token;
            Next();
            double rhs = Term();
            value = op == "+" ? value + rhs : value - rhs;
        }
        return value;
    }

    // term := factor (('*' | '/') factor)*
    private double Term()
    {
        double value = Factor();
        while (_token is "*" or "/")
        {
            string op = _token;
            Next();
            double rhs = Factor();
            value = op == "*" ? value * rhs : value / rhs;
        }
        return value;
    }

    // factor := '-' factor | '(' expr ')' | number | field
    private double Factor()
    {
        if (_token == "-") { Next(); return -Factor(); }
        if (_token == "(")
        {
            Next();
            double value = Expr();
            if (_token != ")") throw new FormatException("missing closing parenthesis");
            Next();
            return value;
        }
        string token = _token ?? throw new FormatException("unexpected end of formula");
        if (char.IsDigit(token[0]) || token[0] == '.')
        {
            Next();
            return double.Parse(token, System.Globalization.CultureInfo.InvariantCulture);
        }
        if (char.IsLetter(token[0]) || token[0] == '_')
        {
            if (!Fields.Contains(token)) throw new FormatException($"unknown field \"{token}\"");
            Next();
            return token switch
            {
                "price" => _row.price,
                "quantity" => _row.quantity,
                _ => _row.discount,
            };
        }
        throw new FormatException($"unexpected token \"{token}\"");
    }
}

// The API names that appear in copied Roslyn-to-RCE payloads. Case-sensitive.
private static readonly string[] Blocked =
{
    "Process", "Diagnostics", "Runtime", "File", "Directory",
    "Assembly", "Activator", "AppDomain", "Reflection", "GetType",
};

public double Evaluate(string formula, QuoteRow row)
{
    foreach (var word in Blocked)
    {
        if (formula.Contains(word, StringComparison.Ordinal))
        {
            throw new InvalidOperationException("formula contains a blocked API");
        }
    }
    // The denylist blocks the gadgets but not Environment.GetEnvironmentVariable, so a secret
    // read still compiles and runs.
    return CSharpScript.EvaluateAsync<double>(formula, Options, globals: row).GetAwaiter().GetResult();
}

// The caller sends a pricing formula and a row of numbers. The evaluator returns a number or
// throws; a formula it will not compute is a 400, never a 500, and the formula is never run as code.
app.MapPost("/quote", (QuoteRequest body, IFormulaEvaluator evaluator) =>
{
    if (string.IsNullOrEmpty(body.Formula) || body.Formula.Length > 500)
    {
        return Results.BadRequest(new { error = "formula must be a non-empty string under 500 chars" });
    }
    var row = body.Row ?? new QuoteRow();
    try
    {
        double result = evaluator.Evaluate(body.Formula, row);
        return double.IsFinite(result)
            ? Results.Ok(new { result })
            : Results.BadRequest(new { error = "formula did not produce a finite number" });
    }
    catch (Exception e)
    {
        return Results.BadRequest(new { error = $"cannot evaluate formula: {e.Message}" });
    }
});