{"record":{"id":"7507ae4e06c8d3dd","repo":"cube-js/cube","slug":"insecure-method-call","errorCode":null,"errorMessage":"insecure method call","messagePattern":"insecure method call","errorType":"exception","errorClass":"minijinja::Error","httpStatus":null,"severity":"error","filePath":"packages/cubejs-backend-native/src/template/mj_value/value.rs","lineNumber":52,"sourceCode":"impl Object for JinjaSequenceObject {\n    fn kind(&self) -> ObjectKind<'_> {\n        ObjectKind::Seq(self)\n    }\n\n    fn call(&self, _state: &mj::State, _args: &[Value]) -> Result<Value, mj::Error> {\n        Err(mj::Error::new(\n            minijinja::ErrorKind::InvalidOperation,\n            \"insecure call\",\n        ))\n    }\n\n    fn call_method(\n        &self,\n        _state: &mj::State,\n        _name: &str,\n        _args: &[Value],\n    ) -> Result<Value, mj::Error> {\n        Err(mj::Error::new(\n            minijinja::ErrorKind::InvalidOperation,\n            \"insecure method call\",\n        ))\n    }\n}\n\npub struct JinjaDictObject {\n    pub(crate) inner: CLReprObject,\n}\n\nimpl std::fmt::Debug for JinjaDictObject {\n    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n        std::fmt::Debug::fmt(&self.inner, f)\n    }\n}\n\nimpl std::fmt::Display for JinjaDictObject {\n    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-backend-native/src/template/mj_value/value.rs#L34-L70","documentation":"A security sentinel guard: a method was invoked on a Jinja sequence object (e.g. {{ mylist.append(...) }}). Sequence objects expose no methods to templates by design — method dispatch could reach arbitrary underlying code — so any method call is rejected with this fixed message regardless of the method name.","triggerScenarios":"Thrown at packages/cubejs-backend-native/src/template/mj_value/value.rs:52 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use indexing or iteration for sequence data instead of method calls","Perform the needed transformation in Python before exposing the value to the template"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}