{"record":{"id":"4130f48ff135e0a4","repo":"twigphp/Twig","slug":"only-include-tags-are-allowed-within-a-sandbox-section","errorCode":null,"errorMessage":"Only \"include\" tags are allowed within a \"sandbox\" section.","messagePattern":"Only \"include\" tags are allowed within a \"sandbox\" section\\.","errorType":"exception","errorClass":"SyntaxError","httpStatus":null,"severity":"error","filePath":"src/TokenParser/SandboxTokenParser.php","lineNumber":53,"sourceCode":"    {\n        $stream = $this->parser->getStream();\n        trigger_deprecation('twig/twig', '3.15', \\sprintf('The \"sandbox\" tag is deprecated in \"%s\" at line %d.', $stream->getSourceContext()->getName(), $token->getLine()));\n\n        $stream->expect(Token::BLOCK_END_TYPE);\n        $body = $this->parser->subparse([$this, 'decideBlockEnd'], true);\n        $stream->expect(Token::BLOCK_END_TYPE);\n\n        // in a sandbox tag, only include tags are allowed\n        if ($body instanceof IncludeNode) {\n            $body->setAttribute('sandboxed', true);\n        } else {\n            foreach ($body as $node) {\n                if ($node instanceof TextNode && ctype_space($node->getAttribute('data'))) {\n                    continue;\n                }\n\n                if (!$node instanceof IncludeNode) {\n                    throw new SyntaxError('Only \"include\" tags are allowed within a \"sandbox\" section.', $node->getTemplateLine(), $stream->getSourceContext());\n                }\n\n                $node->setAttribute('sandboxed', true);\n            }\n        }\n\n        return new SandboxNode($body, $token->getLine());\n    }\n\n    public function decideBlockEnd(Token $token): bool\n    {\n        return $token->test('endsandbox');\n    }\n\n    public function getTag(): string\n    {\n        return 'sandbox';\n    }","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/twigphp/Twig/blob/a414c3a491defb5a60f2fc88ef79ff37c90010cd/src/TokenParser/SandboxTokenParser.php#L35-L71","documentation":"A {% sandbox %} block may only contain {% include %} tags (whitespace text nodes are ignored). The sandbox exists to evaluate untrusted templates safely, and only includes of sandboxed templates are permitted; any other tag inside is a syntax error.","triggerScenarios":"Writing '{% sandbox %}{% for x in y %}...{% endfor %}{% endsandbox %}' or placing any tag other than include (e.g. 'set', 'if', raw text output) directly inside a sandbox section; SandboxTokenParser::parse throws when a body node is not an IncludeNode.","commonSituations":"Assuming {% sandbox %} sandboxes arbitrary template code (it only guards included templates); wrapping existing template snippets in sandbox and forgetting to move their logic into separate templates included via {% include %}.","solutions":["Move all logic into a separate template and inside the sandbox use only '{% include \"untrusted.html.twig\" %}'","Ensure the included template is registered via sundry/security policy with SandboxExtension enabled","Remove the sandbox wrapper if you don't actually need sandboxing of untrusted includes"],"exampleFix":"// before\n{% sandbox %}{% set x = 1 %}{{ x }}{% endsandbox %}\n// after\n{% sandbox %}{% include 'untrusted.html.twig' %}{% endsandbox %}","handlingStrategy":"validation","validationCode":"// Only permit include tags inside sandbox blocks\nif (preg_match('/\\{%-?\\s*sandbox\\b.*?\\{%-?\\s*endsandbox/s', $src, $m) && preg_match('/\\{%-?\\s*(?!include\\b|endsandbox)(\\w+)/s', $m[0], $bad)) {\n    throw new InvalidArgumentException(sprintf('Tag \"%s\" is not allowed inside a sandbox block.', $bad[1]));\n}","typeGuard":null,"tryCatchPattern":"try {\n    $twig->render($untrustedTemplate);\n} catch (SyntaxError $e) {\n    // reject untrusted template: only include-in-sandbox templates are accepted\n}","preventionTips":["Remember {% sandbox %} only wraps {% include %} calls, not arbitrary code","Keep untrusted templates free of tags; put all logic in trusted wrapper templates","Enable and configure Twig\\Extension\\SandboxExtension with a proper policy"],"tags":["twig","sandbox","security","syntax-error"],"backgroundTag":"unsupported-operation","analyzedSha":"a414c3a491defb5a60f2fc88ef79ff37c90010cd","analyzedAt":"2026-09-13T15:10:46.849Z","contentChangedAt":"2026-09-13T15:10:46.849Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}