对于字符串谓词，我应该采取什么样的安全措施？

问：

我正在使用动态 linq 核心库将筛选器作为字符串获取。在这里，我向apiye发送一个字符串表达式。我正在使用 apide 动态 linq 核心库将我的字符串表达式解析为表达式。为了安全起见，我应该遵循什么路径？例如，我在下面创建了一个名为 ValidatePredicate 的方法。你对此有什么建议吗？

public class ValidatePredicate
{
    private static readonly Dictionary<Type, string[]> AllowedFieldsByType = new Dictionary<Type, string[]>
    {
        { typeof(OrganisationItem), new[] { nameof(OrganisationItem.ItemType), nameof(OrganisationItem.OrganisationItemName), nameof(OrganisationItem.isActive), nameof(OrganisationItem.UpdatedDate) } },
        // The fields that will be allowed for other entities should be written.        };
    public bool ValidatePredicateString<TEntity>(string predicate)
    {
        // entity'nin izin verilen alanlarini aliriz
        if (!AllowedFieldsByType.TryGetValue(typeof(TEntity), out var allowedFields))
        {
            return false; // returns false if it is a disallowed round          }

        // Allowed operators
        var allowedOperators = new[] { "==", "<=", ">=", "!=", "<", ">", ".Contains" };

        // 
        var parts = Regex.Split(predicate, @"&&|\|\|"); //'$$' to '||' in the predicate expression removes expressions

        foreach (var part in parts)
        {
            var trimmedPart = part.Trim(); //removes spaces in part
            bool validPart = false;

            //we control each operator.
            foreach (var op in allowedOperators)
            {
                if (op == ".Contains")
                {
                    var match = Regex.Match(trimmedPart, @"(\w+)\.Contains\(");
                    if (match.Success && allowedFields.Contains(match.Groups[1].Value)) //We get the name before the .contains statement.
                    {
                        validPart = true;
                        break;
                    }
                }
                else
                {
                    var segments = trimmedPart.Split(new[] { op }, StringSplitOptions.None);
                    var leftSegment = segments[0].Trim(); //The name to the left of the operator in the relevant expression is taken

                    if (allowedFields.Contains(leftSegment)) //check if the left side matches the allowed fields
                    {
                        validPart = true;
                        break;
                    }
                }
            }

            if (!validPart)
            {
                return false; // Returns false if a disallowed entity property name is found
            }
        }


        //check allowed operators
        //foreach (var op in allowedOperators)
        //{
        //  if (predicate.Contains(op))
        //  {
        //      continue;
        //  }

        //  return false; // Returns false if operator is not allowed
        //}

        //';' in expression returns false if
        if (predicate.Contains(";"))
        {
            return false;
        }

        return true;
    }

}