{"record":{"id":"1db6446a4954c451","repo":"twigphp/Twig","slug":"the-sandbox-requires-a-strict-security-policy-call-setstrict","errorCode":null,"errorMessage":"The sandbox requires a strict security policy, call \"setStrict(true)\" on a dedicated policy for this sandbox.","messagePattern":"The sandbox requires a strict security policy, call \"setStrict\\(true\\)\" on a dedicated policy for this sandbox\\.","errorType":"exception","errorClass":"LogicException","httpStatus":null,"severity":"error","filePath":"src/Sandbox/Sandbox.php","lineNumber":37,"sourceCode":" * Renders untrusted templates in a dedicated, always-sandboxed environment.\n *\n * The sandbox takes ownership of an environment crafted specifically for it:\n * its loader defines which templates are reachable, its extensions, filters,\n * functions, tests, and globals define which capabilities exist, and the\n * security policy defines what is allowed to execute. Never pass an\n * application environment: the sandbox environment must be dedicated to\n * rendering untrusted templates.\n *\n * @author Fabien Potencier <fabien@symfony.com>\n */\nfinal class Sandbox implements SandboxInterface\n{\n    public function __construct(\n        private Environment $env,\n        SecurityPolicyInterface $policy,\n    ) {\n        if ($policy instanceof SecurityPolicy && !$policy->isStrict()) {\n            throw new \\LogicException('The sandbox requires a strict security policy, call \"setStrict(true)\" on a dedicated policy for this sandbox.');\n        }\n\n        try {\n            $env->addExtension(new SandboxExtension($policy, true));\n        } catch (\\LogicException $e) {\n            throw new \\LogicException(\\sprintf('The environment passed to \"%s\" must be dedicated to it: pass a freshly built environment that has no \"%s\" registered and has not been used yet.', self::class, SandboxExtension::class), 0, $e);\n        }\n    }\n\n    public function render(string $name, array $context = []): string\n    {\n        return $this->env->render($name, $context);\n    }\n\n    public function display(string $name, array $context = []): void\n    {\n        $this->env->display($name, $context);\n    }","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/twigphp/Twig/blob/a414c3a491defb5a60f2fc88ef79ff37c90010cd/src/Sandbox/Sandbox.php#L19-L55","documentation":"Twig's Sandbox must be constructed with a strict security policy. If you pass a SecurityPolicy (the default policy implementation) whose isStrict() flag is false, the constructor rejects it with this LogicException, because non-strict policies do not provide the guarantees the sandbox relies on.","triggerScenarios":"new Sandbox($env, $policy) where $policy is a SecurityPolicy created without ->setStrict(true) (or after calling setStrict(false)), typically with allowed tags/filters/methods configured but strictness left at the default off.","commonSituations":"Setting up sandboxed template rendering for user-supplied templates and forgetting the setStrict(true) call; copying sandbox setup code from older Twig examples predating strictness requirements.","solutions":["Call setStrict(true) on the SecurityPolicy before passing it to the Sandbox constructor.","If a permissive policy is genuinely needed, do not use Sandbox; use sandbox checks (isSandbled/twig sandbox functions) with the policy directly via SandboxExtension.","Verify no code path later flips strictness back off after construction."],"exampleFix":"// before\n$policy = new SecurityPolicy([], [], [], [], []);\n$sandbox = new Sandbox($env, $policy); // throws\n\n// after\n$policy = new SecurityPolicy(['include'], [], [], [], []);\n$policy->setStrict(true);\n$sandbox = new Sandbox($env, $policy);","handlingStrategy":"validation","validationCode":"$policy->setStrict(true);\nif ($policy instanceof \\Twig\\Sandbox\\SecurityPolicy && !$policy->isStrict()) {\n    throw new \\LogicException('Sandbox policy must be strict');\n}","typeGuard":null,"tryCatchPattern":"try { $sandbox = new \\Twig\\Sandbox\\Sandbox($env, $policy); } catch (\\LogicException $e) { if (str_contains($e->getMessage(), 'setStrict(true)')) { $policy->setStrict(true); $sandbox = new \\Twig\\Sandbox\\Sandbox($env, $policy); } else { throw $e; } }","preventionTips":["Always call setStrict(true) immediately after constructing SecurityPolicy for sandbox use","Centralize sandbox setup in a factory so strictness is never forgotten","Add a unit test asserting the sandbox construction succeeds"],"tags":["twig","php","security","sandbox","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"a414c3a491defb5a60f2fc88ef79ff37c90010cd","analyzedAt":"2026-09-13T15:10:46.849Z","contentChangedAt":"2026-09-13T15:10:46.849Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}