Error: Function "include" is not allowed, when using TWIG debug template

[kernie]

Hello,

I created a working local docker install of Kimai (2.23.0) and loaded the demo database. After that I wanted to test the debug template (https://www.kimai.org/documentation/invoices.html, under "Twig templates").

When applying this with an invoice template and data of the demo install, I get an error:

Twig\Sandbox\SecurityNotAllowedFunctionError:
Function "include" is not allowed.

  at vendor/symfony/web-profiler-bundle/Resources/views/Profiler/toolbar_js.html.twig:2
  at Twig\Sandbox\SecurityPolicy->checkSecurity(array('if'), array('escape', 'raw', 'json_encode', 'e', 'length'), array('include', 'url'))
     (src/Twig/SecurityPolicy/ChainPolicy.php:31)
  at App\Twig\SecurityPolicy\ChainPolicy->checkSecurity(array('if'), array('escape', 'raw', 'json_encode', 'e', 'length'), array('include', 'url'))
     (src/Twig/SecurityPolicy/InvoicePolicy.php:202)
  at App\Twig\SecurityPolicy\InvoicePolicy->checkSecurity(array('if'), array('escape', 'raw', 'json_encode', 'e', 'length'), array('include', 'url'))
     (vendor/twig/twig/src/Extension/SandboxExtension.php:88)
  at Twig\Extension\SandboxExtension->checkSecurity(array('if'), array('escape', 'raw', 'json_encode', 'e', 'length'), array('include', 'url'), object(Source))
     (var/cache/dev/twig/06/069f5a98a8d84070a99c23fe3b5d93b1.php:1455)
  at __TwigTemplate_73553b8c95c8ac0aaf8fe39b700054d5->checkSecurity()
     (var/cache/dev/twig/06/069f5a98a8d84070a99c23fe3b5d93b1.php:37)
  at __TwigTemplate_73553b8c95c8ac0aaf8fe39b700054d5->__construct(object(Environment))
     (vendor/twig/twig/src/Environment.php:402)
  at Twig\Environment->loadTemplate('__TwigTemplate_73553b8c95c8ac0aaf8fe39b700054d5', '@WebProfiler/Profiler/toolbar_js.html.twig')
     (vendor/twig/twig/src/Environment.php:343)
  at Twig\Environment->load('@WebProfiler/Profiler/toolbar_js.html.twig')
     (vendor/twig/twig/src/Environment.php:306)
  at Twig\Environment->render('@WebProfiler/Profiler/toolbar_js.html.twig', array('full_stack' => false, 'excluded_ajax_paths' => '^/((index|app(_[\\w]+)?)\\.php/)?_wdt', 'token' => 'dd4663', 'request' => object(Request), 'csp_script_nonce' => 'e0d6168b5806b473eeb50a396af66748', 'csp_style_nonce' => 'f158772197b94c7fb283b9183146edd9'))
     (vendor/symfony/web-profiler-bundle/EventListener/WebDebugToolbarListener.php:143)
  at Symfony\Bundle\WebProfilerBundle\EventListener\WebDebugToolbarListener->injectToolbar(object(Response), object(Request), array('csp_script_nonce' => 'e0d6168b5806b473eeb50a396af66748', 'csp_style_nonce' => 'f158772197b94c7fb283b9183146edd9'))
     (vendor/symfony/web-profiler-bundle/EventListener/WebDebugToolbarListener.php:131)
  at Symfony\Bundle\WebProfilerBundle\EventListener\WebDebugToolbarListener->onKernelResponse(object(ResponseEvent), 'kernel.response', object(TraceableEventDispatcher))
     (vendor/symfony/event-dispatcher/Debug/WrappedListener.php:116)
  at Symfony\Component\EventDispatcher\Debug\WrappedListener->__invoke(object(ResponseEvent), 'kernel.response', object(TraceableEventDispatcher))
     (vendor/symfony/event-dispatcher/EventDispatcher.php:220)
  at Symfony\Component\EventDispatcher\EventDispatcher->callListeners(array(object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener)), 'kernel.response', object(ResponseEvent))
     (vendor/symfony/event-dispatcher/EventDispatcher.php:56)
  at Symfony\Component\EventDispatcher\EventDispatcher->dispatch(object(ResponseEvent), 'kernel.response')
     (vendor/symfony/event-dispatcher/Debug/TraceableEventDispatcher.php:139)
  at Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher->dispatch(object(ResponseEvent), 'kernel.response')
     (vendor/symfony/http-kernel/HttpKernel.php:214)
  at Symfony\Component\HttpKernel\HttpKernel->filterResponse(object(Response), object(Request), 1)
     (vendor/symfony/http-kernel/HttpKernel.php:202)
  at Symfony\Component\HttpKernel\HttpKernel->handleRaw(object(Request), 1)
     (vendor/symfony/http-kernel/HttpKernel.php:76)
  at Symfony\Component\HttpKernel\HttpKernel->handle(object(Request), 1, true)
     (vendor/symfony/http-kernel/Kernel.php:197)
  at Symfony\Component\HttpKernel\Kernel->handle(object(Request))
     (vendor/symfony/runtime/Runner/Symfony/HttpKernelRunner.php:35)
  at Symfony\Component\Runtime\Runner\Symfony\HttpKernelRunner->run()
     (vendor/autoload_runtime.php:29)
  at require_once('/opt/kimai/vendor/autoload_runtime.php')
     (public/index.php:5)            

Any idea what's going wrong?

Thanks!

[kevinpapst]

Thanks for the info 👍 A documentation is always a "moving target".
That example was likely pretty old and not up-to-date.

Due to security reasons, there is a strict sandbox environment used for invoices:
https://github.com/kimai/kimai/blob/main/src/Twig/SecurityPolicy/InvoicePolicy.php

I removed the example and added a sentence that include and embed are not allowed.

[de-es]

I guess OP wasn't struggling with a custom include in a template but with the default Symfony WebProfiler Toolbar toolbar_js.html.twig which uses includes: https://github.com/symfony/web-profiler-bundle/blob/7.1/Resources/views/Profiler/toolbar_js.html.twig

As soon as I switch to the dev environment, I get the same error while trying to debug a html invoice template. I had to add several other functions and tags to the policy the get it to work.