Twig_Sandbox_SecurityError: Calling "setOption" method on RC4 I'm porting light_skeleton to Drupal 8, and it was working fine on RC2 but I ran into this issue after updating to Drupal 8 RC4.

Twig_Sandbox_SecurityError: Calling "setOption" method on a "Drupal\Core\Url" object is not allowed in "themes/light_skeleton/template/html.html.twig" at line 55. in Drupal\Core\Template\TwigSandboxPolicy-&gt;checkMethodAllowed() (line 101 of core/lib/Drupal/Core/Template/TwigSandboxPolicy.php).


After debugging I find out that it was due to this line:

{{ link(item.title, item.url.setOptions({'set_active_class' : TRUE, 'attributes' : {'class' : 'navbar-link'}})) }}


Which I stole from - Custom classes for menu links  and it was working until RC4.

My question is what I'm doing wrong in here ? All I'm doing in there is setting up a variable into the links and in addition setting up the links if the link is active.

There seem to be a similar issue with the bear skin theme. You can look at this issue Twig_Sandbox_SecurityError

Update

Here is the results after debuggin on item.url {{ kint(item.url) }}
RC4 (this is the one that does not work)


RC2 - this how it use to be and it was working.
Core recently added a default sandbox so that it's not possible to e.g. call the delete method on node objects.

See https://www.drupal.org/node/2513266, you can bring it up there and try to allow it, try to extend it yourself or call that option in preprocess. Not sure what the best option is.