{"record":{"id":"67cf17dbad1c2b9a","repo":"twigphp/Twig","slug":"the-output-strategy-argument-of-the-render-sandboxed","errorCode":null,"errorMessage":"The \"output_strategy\" argument of the \"render_sandboxed\" function must be a non-empty literal string other than \"all\".","messagePattern":"The \"output_strategy\" argument of the \"render_sandboxed\" function must be a non-empty literal string other than \"all\"\\.","errorType":"exception","errorClass":"SyntaxError","httpStatus":null,"severity":"error","filePath":"src/Node/Expression/FunctionNode/RenderSandboxedFunction.php","lineNumber":35,"sourceCode":"use Twig\\Node\\Expression\\FunctionExpression;\nuse Twig\\Node\\Node;\n\n/**\n * @internal\n */\nfinal class RenderSandboxedFunction extends FunctionExpression\n{\n    public function compile(Compiler $compiler): void\n    {\n        $arguments = $this->getNode('arguments');\n        $outputStrategyName = self::getOutputStrategyName($arguments);\n        if (null === $outputStrategyName) {\n            throw new SyntaxError('Value for argument \"output_strategy\" is required for function \"render_sandboxed\".', $this->getTemplateLine(), $this->getSourceContext());\n        }\n\n        $outputStrategy = $arguments->getNode($outputStrategyName);\n        if (!$outputStrategy instanceof ConstantExpression) {\n            throw new SyntaxError('The \"output_strategy\" argument of the \"render_sandboxed\" function must be a non-empty literal string other than \"all\".', $outputStrategy->getTemplateLine(), $outputStrategy->getSourceContext());\n        }\n\n        $strategy = $outputStrategy->getAttribute('value');\n        if (!\\is_string($strategy) || '' === $strategy || 'all' === $strategy) {\n            throw new SyntaxError('The \"output_strategy\" argument of the \"render_sandboxed\" function must be a non-empty literal string other than \"all\".', $outputStrategy->getTemplateLine(), $outputStrategy->getSourceContext());\n        }\n\n        $runtimeArguments = clone $arguments;\n        $runtimeArguments->removeNode($outputStrategyName);\n        $this->setNode('arguments', $runtimeArguments);\n        try {\n            parent::compile($compiler);\n        } finally {\n            $this->setNode('arguments', $arguments);\n        }\n    }\n\n    /**","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/twigphp/Twig/blob/a414c3a491defb5a60f2fc88ef79ff37c90010cd/src/Node/Expression/FunctionNode/RenderSandboxedFunction.php#L17-L53","documentation":"Twig's render_sandboxed() function compiles its output_strategy argument at compile time, so it must be a literal string constant known when the template is compiled. Twig rejects non-constant expressions and any string that is empty or 'all' (meaningless here because render_sandboxed renders a single included template, not all).","triggerScenarios":"Calling {% render_sandboxed with {output_strategy: someVar} %} where the value is a variable/expression, an empty string, or the literal 'all'.","commonSituations":"Passing the strategy from config or a template variable instead of a literal; copying code that used the old 'all' default from an older Twig sandboxing example.","solutions":["Pass a literal string strategy such as 'js' or an allowed strategy name directly in the template","Remove output_strategy entirely if you want default behavior","Check allowed strategy names in the sandbox extension and use one verbatim"],"exampleFix":"// before\n{% render_sandboxed with { output_strategy: strategyVar } %}\n// after\n{% render_sandboxed with { output_strategy: 'js' } %}","handlingStrategy":"validation","validationCode":"$allowed = ['js','css','html'];\nif (!is_string($strategy) || '' === $strategy || 'all' === $strategy || !in_array($strategy, $allowed, true)) {\n    throw new InvalidArgumentException('output_strategy must be a literal non-empty strategy name');\n}","typeGuard":"function isValidOutputStrategy(mixed $s): bool {\n    return is_string($s) && '' !== $s && 'all' !== $s;\n}","tryCatchPattern":"try {\n    $twig->load('page.html');\n} catch (\\Twig\\Error\\SyntaxError $e) {\n    // inspect $e->getMessage() for output_strategy problems\n}","preventionTips":["Always pass output_strategy as a literal in templates","Keep a list of valid strategies near template docs","Never interpolate the strategy from runtime values"],"tags":["twig","compile-time","sandbox","template"],"backgroundTag":"invalid-argument-value","analyzedSha":"a414c3a491defb5a60f2fc88ef79ff37c90010cd","analyzedAt":"2026-09-13T15:10:46.849Z","contentChangedAt":"2026-09-13T15:10:46.849Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}