Security and integration

What the language exposes

There are no Icecream directives for HTTP requests, environment variables, filesystem access, database writes, process execution or AI calls. Output such as a shell command or sys.call JSON remains text until a consumer acts on it.

This does not make the renderer a sandbox: property getters, IEnumerable enumeration, serialization and IIceDocResolver.ResolveDocument run host code. The resolver may read files or call a service if the application implements it that way.

Control data and includes

Pass data-only models containing only information the template is allowed to read. A template can access #root from nested includes. Property traversal is not governed by a field-level permission system.

Authorize resolver keys and bound access to templates. Do not treat an arbitrary template name as a trusted file path or URL. Detect include cycles in the host; the library has no recursion limit. Avoid sharing EvalContext between requests, and discard it after an exception.

Validate and encode output

Validate completed JSON and any required schema before consuming it. JSON-looking strings may pass through filters unchanged. The presence of a type, role or constraints field does not authorize an action.

There is no automatic HTML encoding, SQL parameterization, shell quoting or URL encoding. Apply the controls appropriate to the eventual sink. The examples and playground display output as encoded text rather than interpreting it as HTML.

Bound resource use

Nested loops, repeated captures and recursive includes can consume large amounts of CPU or memory. The library has no cancellation, maximum render time, output-size limit or iteration budget. Applications accepting hostile templates need an isolated, resource-limited execution boundary or a restricted template policy.

The website playground has request-size limits and a fixed include resolver. These are basic host controls, not a general-purpose sandbox or a guarantee against expensive templates. Keep it behind appropriate deployment controls for your audience.

Prompts and downstream actions

Prompt text can contain untrusted instructions even when its JSON is valid. The receiving application must decide which data and tools a model can use. Do not grant authority because a projection asks for it. Validate inputs and responses and apply your own approval and audit policies.

This website’s playground

Rendering sends the entered model and icedoc to this website’s server. It does not call an AI service or execute projected commands. Only the bundled QuoteLine include is available; other names produce an explicit error. Use sample data rather than credentials or private business information. See data use.