cube-js/cube · error · minijinja::Error

insecure method call

Error message

insecure method call

What it means

A security sentinel guard: a method was invoked on a Jinja sequence object (e.g. {{ mylist.append(...) }}). Sequence objects expose no methods to templates by design — method dispatch could reach arbitrary underlying code — so any method call is rejected with this fixed message regardless of the method name.

Source

Thrown at packages/cubejs-backend-native/src/template/mj_value/value.rs:52

impl Object for JinjaSequenceObject {
    fn kind(&self) -> ObjectKind<'_> {
        ObjectKind::Seq(self)
    }

    fn call(&self, _state: &mj::State, _args: &[Value]) -> Result<Value, mj::Error> {
        Err(mj::Error::new(
            minijinja::ErrorKind::InvalidOperation,
            "insecure call",
        ))
    }

    fn call_method(
        &self,
        _state: &mj::State,
        _name: &str,
        _args: &[Value],
    ) -> Result<Value, mj::Error> {
        Err(mj::Error::new(
            minijinja::ErrorKind::InvalidOperation,
            "insecure method call",
        ))
    }
}

pub struct JinjaDictObject {
    pub(crate) inner: CLReprObject,
}

impl std::fmt::Debug for JinjaDictObject {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        std::fmt::Debug::fmt(&self.inner, f)
    }
}

impl std::fmt::Display for JinjaDictObject {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

View on GitHub (pinned to 7d981676b3)

Solutions

1. Use indexing or iteration for sequence data instead of method calls
2. Perform the needed transformation in Python before exposing the value to the template

When it happens

Trigger: Thrown at packages/cubejs-backend-native/src/template/mj_value/value.rs:52 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/7507ae4e06c8d3dd. Report an issue: GitHub.