{"record":{"id":"1ac72b01dd0d58bb","repo":"twigphp/Twig","slug":"accessing-twig-template-attributes-is-forbidden","errorCode":null,"errorMessage":"Accessing \\Twig\\Template attributes is forbidden.","messagePattern":"Accessing \\\\Twig\\\\Template attributes is forbidden\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"src/Extension/CoreExtension.php","lineNumber":1850,"sourceCode":"            }\n\n            if ($ignoreStrictCheck || !$env->isStrictVariables()) {\n                return;\n            }\n\n            if (null === $object) {\n                $message = \\sprintf('Impossible to invoke a method (\"%s\") on a null variable.', $item);\n            } elseif (\\is_array($object)) {\n                $message = \\sprintf('Impossible to invoke a method (\"%s\") on a sequence/mapping.', $item);\n            } else {\n                $message = \\sprintf('Impossible to invoke a method (\"%s\") on a %s variable (\"%s\").', $item, get_debug_type($object), $object);\n            }\n\n            throw new RuntimeError($message, $lineno, $source);\n        }\n\n        if ($object instanceof Template) {\n            throw new RuntimeError('Accessing \\Twig\\Template attributes is forbidden.', $lineno, $source);\n        }\n\n        // object property\n        if (Template::METHOD_CALL !== $type) {\n            if ($sandboxed) {\n                try {\n                    $env->getExtension(SandboxExtension::class)->getChecker()->checkPropertyAllowed($object, $item, $lineno, $source);\n                } catch (SecurityNotAllowedPropertyError $propertyNotAllowedError) {\n                    goto methodCheck;\n                }\n            }\n\n            static $propertyCheckers = [];\n\n            if (isset($object->$item)\n                || ($propertyCheckers[$object::class][$item] ??= self::getPropertyChecker($object::class, $item))($object, $item)\n            ) {\n                if ($isDefinedTest) {","sourceCodeStart":1832,"sourceCodeEnd":1868,"githubUrl":"https://github.com/twigphp/Twig/blob/a414c3a491defb5a60f2fc88ef79ff37c90010cd/src/Extension/CoreExtension.php#L1832-L1868","documentation":"CoreExtension::getAttribute() forbids accessing attributes or calling methods on a \\Twig\\Template instance itself. This guards template internals (blocks, sources, env) from being inspected or mutated from inside templates.","triggerScenarios":"A template variable holds a Twig\\Template object (or a template is passed as context value) and the template does {{ template.someAttr }} or {{ template.someMethod() }}.","commonSituations":"Passing a Template object into the context by mistake (e.g. from a custom extension returning $this or a loaded template), or iterating over template instances; experimental/internal code doing reflection-ish access from templates.","solutions":["Remove the Template instance from the template context; pass plain data instead","If you loaded a template by accident (env->load(...)), render it or use ->renderBlock() server-side rather than passing the object","Unwrap the value: pass $template->getSourceContext() or rendered output instead of the object"],"exampleFix":"// before (PHP controller)\nreturn $this->render('base.html.twig', ['tpl' => $template]);\n\n// after\nreturn $this->render('base.html.twig', ['content' => $template->render([])]);","handlingStrategy":"type-guard","validationCode":"foreach ($context as $k => $v) { if ($v instanceof \\Twig\\Template) { throw new \\RuntimeException(\"Context key '$k' holds a Template object\"); } }","typeGuard":"function isTwigTemplate($v): bool { return $v instanceof \\Twig\\Template; }","tryCatchPattern":"try { $twig->render($tpl, $ctx); } catch (\\Twig\\Error\\RuntimeError $e) { if (str_contains($e->getMessage(), 'attributes is forbidden')) { /* remove Template from context */ } }","preventionTips":["Never pass Template instances into template context","Render templates server-side and pass strings","Audit custom extensions for returning $this or loaded templates"],"tags":["twig","runtime-error","template-internals"],"backgroundTag":"unsupported-operation","analyzedSha":"a414c3a491defb5a60f2fc88ef79ff37c90010cd","analyzedAt":"2026-09-13T15:10:46.849Z","contentChangedAt":"2026-09-13T15:10:46.849Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}