{"record":{"id":"f80de663d9d98516","repo":"microsoft/semantic-kernel","slug":"argument-propertyname-has-a-value-that-doesn-t","errorCode":null,"errorMessage":"Argument '{propertyName}' has a value that doesn't support automatic encoding. Set AllowDangerouslySetContent to 'true' for this argument and implement custom encoding, or provide the value as a string.","messagePattern":"Argument '(.+?)' has a value that doesn't support automatic encoding\\. Set AllowDangerouslySetContent to 'true' for this argument and implement custom encoding, or provide the value as a string\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"dotnet/src/Extensions/PromptTemplates.Handlebars/HandlebarsPromptTemplate.cs","lineNumber":171,"sourceCode":"        }\n\n        var valueType = propertyValue.GetType();\n\n        var underlyingType = Nullable.GetUnderlyingType(valueType) ?? valueType;\n\n        if (underlyingType == typeof(string))\n        {\n            var stringValue = (string)propertyValue;\n            return HttpUtility.HtmlEncode(stringValue);\n        }\n\n        if (this.IsSafeType(underlyingType))\n        {\n            return propertyValue;\n        }\n\n        // For complex types, throw an exception if dangerous content is not allowed\n        throw new NotSupportedException(\n            $\"Argument '{propertyName}' has a value that doesn't support automatic encoding. \" +\n            $\"Set {nameof(InputVariable.AllowDangerouslySetContent)} to 'true' for this argument and implement custom encoding, \" +\n            \"or provide the value as a string.\");\n    }\n\n    /// <summary>\n    /// Determines if a type is considered safe and doesn't require encoding.\n    /// </summary>\n    /// <param name=\"type\">The type to check.</param>\n    /// <returns>True if the type is safe, false otherwise.</returns>\n    private bool IsSafeType(Type type)\n    {\n        return type == typeof(byte) ||\n               type == typeof(sbyte) ||\n               type == typeof(bool) ||\n               type == typeof(ushort) ||\n               type == typeof(short) ||\n               type == typeof(char) ||","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/dotnet/src/Extensions/PromptTemplates.Handlebars/HandlebarsPromptTemplate.cs#L153-L189","documentation":"Thrown when a Handlebars template argument has a complex (non-string, non-safe) type and AllowDangerouslySetContent is not enabled. The template engine auto-encodes strings and trusts a whitelist of safe types, but rejects anything else to prevent injection unless the caller explicitly opts into unsafe content.","triggerScenarios":"HandlebarsPromptTemplate attempts to render an input variable whose value is a complex object type that is neither string nor whitelisted as safe, and the corresponding InputVariable does not have AllowDangerouslySetContent = true.","commonSituations":"Passing domain objects, collections, or anonymous types as template arguments; forgetting to set AllowDangerouslySetContent when you intentionally want to inject pre-sanitized HTML/structured content; or passing a JSON object instead of a primitive.","solutions":["Pass the argument as a string (serialize the object yourself before passing it) so automatic HTML encoding applies.","Set InputVariable.AllowDangerouslySetContent = true on the variable if you have implemented custom encoding and need the raw object.","Register the type as safe via the supported extension point if it is genuinely safe to inject verbatim."],"exampleFix":"// before\nvariables.Add(new InputVariable { Name = \"item\", Value = myComplexObject });\n// after (option A: string)\nvariables.Add(new InputVariable { Name = \"item\", Value = JsonSerializer.Serialize(myComplexObject) });\n// after (option B: opt into unsafe)\nvariables.Add(new InputVariable { Name = \"item\", Value = myComplexObject, AllowDangerouslySetContent = true });","handlingStrategy":"validation","validationCode":"// Validate argument values before rendering\nforeach (var v in variables)\n{\n    var t = v.Value?.GetType();\n    if (t is not null && t != typeof(string) && !v.AllowDangerouslySetContent)\n        throw new InvalidOperationException($\"Variable '{v.Name}' has a complex type {t}; set AllowDangerouslySetContent or pass a string.\");\n}","typeGuard":"public static bool RequiresUnsafeContent(InputVariable v)\n{\n    var t = v.Value?.GetType();\n    return t is not null && t != typeof(string);\n}","tryCatchPattern":"try\n{\n    var result = await template.RenderAsync(kernel, arguments).ConfigureAwait(false);\n}\ncatch (NotSupportedException ex) when (ex.Message.Contains(\"AllowDangerouslySetContent\"))\n{\n    _logger.LogError(ex, \"Argument needs AllowDangerouslySetContent or string conversion.\");\n    throw;\n}","preventionTips":["Serialize complex arguments to strings before passing them to templates.","Set AllowDangerouslySetContent only after implementing custom encoding.","Keep template arguments to primitive/string types where possible."],"tags":["handlebars","prompt-templates","xss","content-encoding","input-validation"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}