octobercms/october · error · Twig\Sandbox\SecurityNotAllowedMethodError

Calling any method on a "%s" object is blocked.

Error message

Calling any method on a "%s" object is blocked.

What it means

Error "Calling any method on a "%s" object is blocked." thrown in octobercms/october.

Source

Thrown at modules/system/twig/SecurityPolicyLegacy.php:121

    public function checkMethodAllowed($obj, $method): void
    {
        if ($obj instanceof Template || $obj instanceof Markup) {
            return;
        }

        $blockedMethod = strtr($method, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');

        // Check objects
        foreach ($this->blockedClassMethods as $blockedClass => $blockedMethods) {
            if (is_a($obj, $blockedClass) && in_array($blockedMethod, $blockedMethods)) {
                throw new SecurityNotAllowedMethodError(sprintf('Calling "%s" method on a "%s" object is blocked.', $method, $blockedClass), $blockedClass, $method);
            }
        }

        // Check general classes
        foreach ($this->blockedClasses as $blockedClass) {
            if (is_a($obj, $blockedClass)) {
                throw new SecurityNotAllowedMethodError(sprintf('Calling any method on a "%s" object is blocked.', $blockedClass), $blockedClass, $method);
            }
        }

        // Check general methods
        if (in_array($blockedMethod, $this->blockedMethods)) {
            $class = get_class($obj);
            throw new SecurityNotAllowedMethodError(sprintf('Calling "%s" method on a "%s" object is blocked.', $method, $class), $class, $method);
        }
    }

    /**
     * checkPropertyAllowed
     * @throws SecurityNotAllowedPropertyError
     */
    public function checkPropertyAllowed($obj, $property): void
    {
        if (in_array($property, $this->blockedProperties)) {
            $class = get_class($obj);

View on GitHub (pinned to b608633a7e)

When it happens

Trigger: Thrown at modules/system/twig/SecurityPolicyLegacy.php:121 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/a507fee07010d335. Report an issue: GitHub.