{"record":{"id":"4b48f3e564543f3f","repo":"elsa-workflows/elsa-core","slug":"c-workflow-expression-execution-is-disabled-set","errorCode":null,"errorMessage":"C# workflow expression execution is disabled. Set CSharpOptions.AllowHostCodeExecution to true only for trusted workflow authors; Roslyn scripting is not a sandbox.","messagePattern":"C# workflow expression execution is disabled\\. Set CSharpOptions\\.AllowHostCodeExecution to true only for trusted workflow authors; Roslyn scripting is not a sandbox\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Expressions.CSharp/Services/CSharpEvaluator.cs","lineNumber":38,"sourceCode":"/// <remarks>\n/// Initializes a new instance of the <see cref=\"CSharpEvaluator\"/> class.\n/// </remarks>\npublic class CSharpEvaluator(INotificationSender notificationSender, IOptions<CSharpOptions> scriptOptions, IMemoryCache memoryCache) : ICSharpEvaluator\n{\n    private readonly CSharpOptions _csharpOptions = scriptOptions.Value;\n\n    /// <inheritdoc />\n    public async Task<object?> EvaluateAsync(\n        string expression,\n        Type returnType,\n        ExpressionExecutionContext context,\n        ExpressionEvaluatorOptions options,\n        Func<ScriptOptions, ScriptOptions>? configureScriptOptions = default,\n        Func<Script<object>, Script<object>>? configureScript = default,\n        CancellationToken cancellationToken = default)\n    {\n        if (!_csharpOptions.AllowHostCodeExecution)\n            throw new InvalidOperationException(\"C# workflow expression execution is disabled. Set CSharpOptions.AllowHostCodeExecution to true only for trusted workflow authors; Roslyn scripting is not a sandbox.\");\n\n        var scriptOptions = ScriptOptions.Default.WithOptimizationLevel(OptimizationLevel.Release);\n\n        if (configureScriptOptions != null)\n            scriptOptions = configureScriptOptions(scriptOptions);\n\n        var globals = new Globals(context, options.Arguments);\n        var script = CSharpScript.Create(\"\", scriptOptions, typeof(Globals));\n\n        if (configureScript != null)\n            script = configureScript(script);\n\n        var notification = new EvaluatingCSharp(options, script, scriptOptions, context);\n        await notificationSender.SendAsync(notification, cancellationToken);\n        scriptOptions = notification.ScriptOptions;\n        script = notification.Script.ContinueWith(expression, scriptOptions);\n        var runner = GetCompiledScript(script);\n        return await runner(globals, cancellationToken: cancellationToken);","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Expressions.CSharp/Services/CSharpEvaluator.cs#L20-L56","documentation":"The C# expression evaluator intentionally refuses to run Roslyn-scripted workflow expressions unless host code execution is explicitly enabled via CSharpOptions.AllowHostCodeExecution. Because Roslyn scripting is not a sandbox, enabling it lets workflow authors execute arbitrary code on the host, so the default is disabled and this InvalidOperationException is thrown when a C# expression requiring script execution is evaluated.","triggerScenarios":"Evaluating a C# expression that requires scripting (EvaluateAsync with script options) while CSharpOptions.AllowHostCodeExecution is false (the default) — e.g. a workflow using `(C#) ...` expressions with host-level scripting features.","commonSituations":"Deploying workflows using C# script expressions to a host that never opted in; upgrading Elsa where the safety default flipped to disabled; security-hardened production environments rejecting script execution.","solutions":["Set CSharpOptions.AllowHostCodeExecution = true in host configuration, ONLY if workflow authors are fully trusted","Rewrite the workflow expression in a sandboxed-safe language such as JavaScript or a restricted C# expression mode","Move the needed logic into a custom activity or C# method exposed via allowed APIs instead of raw scripting","Confirm which expression in the workflow requires scripting and remove or replace it"],"exampleFix":"// before\nservices.AddCSharpExpressions(); // AllowHostCodeExecution defaults to false\n// after\nservices.AddCSharpExpressions(options => options.AllowHostCodeExecution = true); // trusted authors only","handlingStrategy":"validation","validationCode":"// host-side guard before evaluating C# expressions\nvar opts = serviceProvider.GetRequiredService<IOptions<CSharpOptions>>().Value;\nif (!opts.AllowHostCodeExecution)\n    throw new InvalidOperationException(\"C# scripting is disabled; set CSharpOptions.AllowHostCodeExecution=true only for trusted authors.\");","typeGuard":null,"tryCatchPattern":"try { result = await evaluator.EvaluateAsync(expression, ...); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"AllowHostCodeExecution\"))\n{\n    logger.LogWarning(\"C# script execution blocked: enable AllowHostCodeExecution if authors are trusted\");\n    throw;\n}","preventionTips":["Explicitly decide and document AllowHostCodeExecution in every environment","Prefer JavaScript or non-scripting expression languages for untrusted authors","Never enable host code execution for publicly authored workflows","Alert on this exception in production — it usually means a workflow needs a config change"],"tags":["security","csharp","expressions","configuration","roslyn"],"backgroundTag":"feature-not-enabled","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}