{"record":{"id":"d85b1253aff657e2","repo":"getgrav/grav","slug":"calling-s-method-on-a-s-object-is-not-allowe","errorCode":null,"errorMessage":"Calling \"%s\" method on a \"%s\" object is not allowed.","messagePattern":"Calling \"(.+?)\" method on a \"(.+?)\" object is not allowed\\.","errorType":"exception","errorClass":"SecurityNotAllowedMethodError","httpStatus":null,"severity":"error","filePath":"system/src/Grav/Common/Twig/Sandbox/GravSecurityPolicy.php","lineNumber":92,"sourceCode":"\n        foreach ($functions as $function) {\n            if (!in_array($function, $this->allowedFunctions, true)) {\n                throw new SecurityNotAllowedFunctionError(sprintf('Function \"%s\" is not allowed.', $function), $function);\n            }\n        }\n    }\n\n    public function checkMethodAllowed($obj, $method): void\n    {\n        $method = strtolower($method);\n        foreach ($this->allowedMethods as $class => $methods) {\n            if ($obj instanceof $class && (in_array('*', $methods, true) || in_array($method, $methods, true))) {\n                return;\n            }\n        }\n\n        $class = $obj::class;\n        throw new SecurityNotAllowedMethodError(\n            sprintf('Calling \"%s\" method on a \"%s\" object is not allowed.', $method, $class),\n            $class,\n            $method\n        );\n    }\n\n    /**\n     * True when $obj is an instance of any class in the method allowlist — i.e.\n     * a type sandboxed content is permitted to interact with at all. The\n     * dump/serialize filter guards (print_r, json_encode, yaml_encode, string)\n     * use this to refuse objects that bypass the member gate by serializing PHP\n     * state directly. Note: when `security.twig_content.config_access` is off,\n     * the raw `Config`/`Data` entries are stripped in\n     * Security::buildTwigSandboxPolicy(), so this returns false for them — only\n     * the redacting SandboxConfig facade stays allowed. (GHSA-mc5q-6hpj-rp7j)\n     */\n    public function isClassAllowed(object $obj): bool\n    {","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/getgrav/grav/blob/6040efed04efa69b8209448ed81308e7c24147c2/system/src/Grav/Common/Twig/Sandbox/GravSecurityPolicy.php#L74-L110","documentation":"Error \"Calling \"%s\" method on a \"%s\" object is not allowed.\" thrown in getgrav/grav.","triggerScenarios":"Thrown at system/src/Grav/Common/Twig/Sandbox/GravSecurityPolicy.php:92 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6040efed04efa69b8209448ed81308e7c24147c2","analyzedAt":"2026-08-17T05:07:31.593Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}