getgrav/grav · error · RuntimeException

400

400

Error message

Page content resolves to disallowed markup (%s) after Twig processing. Remove the render-time-assembled tag or attribute.

What it means

Error "Page content resolves to disallowed markup (%s) after Twig processing. Remove the render-time-assembled tag or attribute." thrown in getgrav/grav.

Source

Thrown at system/src/Grav/Common/Flex/Types/Pages/PageObject.php:196

    /**
     * @param array $variables
     * @return array
     */
    protected function onBeforeSave(array $variables)
    {
        $reorder = $variables[0] ?? true;

        // Render-time XSS backstop, enforced at save. Editor-authored Twig in
        // page content can assemble markup the raw-source validator can't see
        // (`{{ "on" ~ "error" }}`, `<s{{ "cript" }}>`); render the sandboxed
        // content-Twig in isolation and reject the save if it resolves to flagged
        // markup. Only editor content is in scope here — no shortcodes/plugins
        // have run — so trusted plugin/theme output can never trip it. Superadmins
        // are exempt (mirrors the raw-source checkSafety). (GHSA-2c4f-86xc-cr74)
        $found = Security::detectXssInEditorContent($this->getRawContent(), $this);
        if ($found !== null) {
            throw new RuntimeException(
                sprintf('Page content resolves to disallowed markup (%s) after Twig processing. Remove the render-time-assembled tag or attribute.', $found),
                400
            );
        }

        $meta = $this->getMetaData();
        if (($meta['copy'] ?? false) === true) {
            $this->folder = $this->getKey();
        }

        // Figure out storage path to the new route.
        $parentKey = $this->getProperty('parent_key');
        if ($parentKey !== '') {
            $parentRoute = $this->getProperty('route');

            // Root page cannot be moved.
            if ($this->root()) {
                throw new RuntimeException(sprintf('Root page cannot be moved to %s', $parentRoute));

View on GitHub (pinned to 6040efed04)

When it happens

Trigger: Thrown at system/src/Grav/Common/Flex/Types/Pages/PageObject.php:196 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of getgrav/grav@6040efed04 (2026-08-17). Data as JSON: /api/errors/20b6663d7fe2ddaf. Report an issue: GitHub.