microsoft/semantic-kernel · error · NotSupportedException

Argument '{propertyName}' has a value that doesn't support a

Error message

Argument '{propertyName}' has a value that doesn't support automatic encoding. Set AllowDangerouslySetContent to 'true' for this argument and implement custom encoding, or provide the value as a string.

What it means

Thrown when a Handlebars template argument has a complex (non-string, non-safe) type and AllowDangerouslySetContent is not enabled. The template engine auto-encodes strings and trusts a whitelist of safe types, but rejects anything else to prevent injection unless the caller explicitly opts into unsafe content.

Source

Thrown at dotnet/src/Extensions/PromptTemplates.Handlebars/HandlebarsPromptTemplate.cs:171

        }

        var valueType = propertyValue.GetType();

        var underlyingType = Nullable.GetUnderlyingType(valueType) ?? valueType;

        if (underlyingType == typeof(string))
        {
            var stringValue = (string)propertyValue;
            return HttpUtility.HtmlEncode(stringValue);
        }

        if (this.IsSafeType(underlyingType))
        {
            return propertyValue;
        }

        // For complex types, throw an exception if dangerous content is not allowed
        throw new NotSupportedException(
            $"Argument '{propertyName}' has a value that doesn't support automatic encoding. " +
            $"Set {nameof(InputVariable.AllowDangerouslySetContent)} to 'true' for this argument and implement custom encoding, " +
            "or provide the value as a string.");
    }

    /// <summary>
    /// Determines if a type is considered safe and doesn't require encoding.
    /// </summary>
    /// <param name="type">The type to check.</param>
    /// <returns>True if the type is safe, false otherwise.</returns>
    private bool IsSafeType(Type type)
    {
        return type == typeof(byte) ||
               type == typeof(sbyte) ||
               type == typeof(bool) ||
               type == typeof(ushort) ||
               type == typeof(short) ||
               type == typeof(char) ||

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Pass the argument as a string (serialize the object yourself before passing it) so automatic HTML encoding applies.
2. Set InputVariable.AllowDangerouslySetContent = true on the variable if you have implemented custom encoding and need the raw object.
3. Register the type as safe via the supported extension point if it is genuinely safe to inject verbatim.

Example fix

// before
variables.Add(new InputVariable { Name = "item", Value = myComplexObject });
// after (option A: string)
variables.Add(new InputVariable { Name = "item", Value = JsonSerializer.Serialize(myComplexObject) });
// after (option B: opt into unsafe)
variables.Add(new InputVariable { Name = "item", Value = myComplexObject, AllowDangerouslySetContent = true });

// Validate argument values before rendering
foreach (var v in variables)
{
    var t = v.Value?.GetType();
    if (t is not null && t != typeof(string) && !v.AllowDangerouslySetContent)
        throw new InvalidOperationException($"Variable '{v.Name}' has a complex type {t}; set AllowDangerouslySetContent or pass a string.");
}

public static bool RequiresUnsafeContent(InputVariable v)
{
    var t = v.Value?.GetType();
    return t is not null && t != typeof(string);
}

try
{
    var result = await template.RenderAsync(kernel, arguments).ConfigureAwait(false);
}
catch (NotSupportedException ex) when (ex.Message.Contains("AllowDangerouslySetContent"))
{
    _logger.LogError(ex, "Argument needs AllowDangerouslySetContent or string conversion.");
    throw;
}

When it happens

Trigger: HandlebarsPromptTemplate attempts to render an input variable whose value is a complex object type that is neither string nor whitelisted as safe, and the corresponding InputVariable does not have AllowDangerouslySetContent = true.

Common situations: Passing domain objects, collections, or anonymous types as template arguments; forgetting to set AllowDangerouslySetContent when you intentionally want to inject pre-sanitized HTML/structured content; or passing a JSON object instead of a primitive.

Related errors

• A helper with the name '{helperName}' is already registered.
• No arguments are provided for {fullyResolvedFunctionName}.
• Invalid argument type for function {functionMetadata.Name}.
• Parameter {param.Name} is required for function {functionMet
• Invalid parameter type for function {functionMetadata.Name}.

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/f80de663d9d98516. Report an issue: GitHub.