{"record":{"id":"57ae9d260fde25a8","repo":"twigphp/Twig","slug":"function-s-is-not-allowed","errorCode":null,"errorMessage":"Function \"%s\" is not allowed.","messagePattern":"Function \"(.+?)\" is not allowed\\.","errorType":"exception","errorClass":"SecurityNotAllowedFunctionError","httpStatus":null,"severity":"error","filePath":"src/Sandbox/SecurityPolicy.php","lineNumber":131,"sourceCode":"            }\n        }\n\n        foreach ($filters as $filter) {\n            if (!\\in_array($filter, $this->allowedFilters, true)) {\n                throw new SecurityNotAllowedFilterError(\\sprintf('Filter \"%s\" is not allowed.', $filter), $filter);\n            }\n        }\n\n        foreach ($functions as $function) {\n            if (!\\in_array($function, $this->allowedFunctions, true)) {\n                if (!$this->strict && 'parent' === $function) {\n                    trigger_deprecation('twig/twig', '3.27', 'The \"parent\" function is always allowed in sandboxes, but won\\'t be in 4.0, please enable it explicitly in your sandbox policy if needed (or enable strict mode on the security policy to opt-in to the 4.0 behavior now).');\n                } elseif (!$this->strict && 'block' === $function) {\n                    trigger_deprecation('twig/twig', '3.27', 'The \"block\" function is always allowed in sandboxes, but won\\'t be in 4.0, please enable it explicitly in your sandbox policy if needed (or enable strict mode on the security policy to opt-in to the 4.0 behavior now).');\n                } elseif (!$this->strict && 'attribute' === $function) {\n                    trigger_deprecation('twig/twig', '3.27', 'The \"attribute\" function is always allowed in sandboxes, but won\\'t be in 4.0, please enable it explicitly in your sandbox policy if needed (or enable strict mode on the security policy to opt-in to the 4.0 behavior now).');\n                } else {\n                    throw new SecurityNotAllowedFunctionError(\\sprintf('Function \"%s\" is not allowed.', $function), $function);\n                }\n            }\n        }\n\n        foreach ($tests as $test) {\n            if (!\\in_array($test, $this->allowedTests, true)) {\n                if (!$this->strict) {\n                    trigger_deprecation('twig/twig', '3.28', 'The \"%s\" test is always allowed in sandboxes, but won\\'t be in 4.0, please enable it explicitly in your sandbox policy if needed (or enable strict mode on the security policy to opt-in to the 4.0 behavior now).', $test);\n                } else {\n                    throw new SecurityNotAllowedTestError(\\sprintf('Test \"%s\" is not allowed.', $test), $test);\n                }\n            }\n        }\n    }\n\n    public function checkMethodAllowed($obj, $method): void\n    {\n        if ($obj instanceof Template || $obj instanceof Markup) {","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/twigphp/Twig/blob/a414c3a491defb5a60f2fc88ef79ff37c90010cd/src/Sandbox/SecurityPolicy.php#L113-L149","documentation":"checkSecurity() throws SecurityNotAllowedFunctionError when the template calls a Twig function not in allowedFunctions. With strict mode disabled, 'parent', 'block', and 'attribute' are temporarily permitted via deprecation notices (removed in 4.0); all other unlisted functions throw.","triggerScenarios":"A sandboxed template calls a function absent from the $functions constructor argument / setAllowedFunctions(); relying on 'parent'/'block'/'attribute' without strict mode (works now, throws in 4.0); a strict-mode policy rejecting any unlisted function.","commonSituations":"Migrating toward Twig 4.0 sandbox semantics; a template gaining a new function call after the policy was written; macro/namespace tests exercising sandbox exemptions.","solutions":["Add the function to the allowlist via the constructor or $policy->setAllowedFunctions([...]).","Explicitly allow 'parent', 'block', 'attribute' if you rely on the pre-4.0 behavior, and enable strict mode to test 4.0 behavior early.","Catch SecurityNotAllowedFunctionError to report the blocked function name.","Wrap function usage in custom whitelisted Twig functions if fine-grained control is needed."],"exampleFix":"// before\n $policy = new SecurityPolicy([], [], [], [], []); // template calls range()\n// after\n $policy = new SecurityPolicy([], [], [], ['range', 'parent', 'block', 'attribute'], []);\n $policy->setStrict(true);","handlingStrategy":"try-catch","validationCode":"if (!in_array($fn, $allowedFunctions, true)) {\n    throw new \\LogicException(\"Function '$fn' not allowed by sandbox policy\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    $html = $twig->render($tpl, $ctx);\n} catch (\\Twig\\Sandbox\\SecurityNotAllowedFunctionError $e) {\n    $logger->warning('Sandbox blocked function', ['function' => $e->getFunctionName()]);\n}","preventionTips":["Explicitly allow parent/block/attribute ahead of the 4.0 removal.","Enable strict mode so implicit allowances stop masking gaps.","Only register trusted, allowlisted functions for sandboxed environments.","Audit templates for new function calls in code review."],"tags":["twig","sandbox","security-policy","functions"],"backgroundTag":"permission-denied","analyzedSha":"a414c3a491defb5a60f2fc88ef79ff37c90010cd","analyzedAt":"2026-09-13T15:10:46.849Z","contentChangedAt":"2026-09-13T15:10:46.849Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}