Q:

Security concern: Can Razor Engine internally make a REST call?

I am developing an API in WebApi (current version 2017), which is using Antaris Razor engine 3.10. Today's current non-beta version. 
A concern was raised that the "Razor engine is powerful" and could make a REST call. Is this possible? 
I understood it to be a templating engine. Is it possible that during the compilation stage or the run stage that the engine could make a REST call? 
I am not rendering the end result of the template in the browser. It is used only to format a JSON/XMl string content to post to a subsequent REST call in the compiled C# API that I am building. 
Does the Antaris Razor Engine have the ability to make a REST call internally?

A:

The answer is yes. The Antaris Razor Engine can make a REST call during the run stage.
It is essentially able to run .Net code. It does more than data binding and token replacement. It joins a model to your template and runs any .Net code you can get to compile.
Some things are slightly more difficult to use, for instance, an implicit conversion to a string doesn't really work. I found .ToString() is required to be called where it may not be if you were writing in Visual Studio. Also, null checking sometimes throws an Object Reference error, even when done as recommended by the project. I found deserializing the object model to a dynamic made null checking more reliable.
All in all, it is a great project, with a ton of power. A little quirkiness won't stop me from using it. 

