mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-09-10 02:59:34 +00:00
Code Issues 32 Releases Wiki Activity

Refs #36588 -- Warned about using external templates in startapp/startproject commands.

Browse Source 
Clarified that custom templates provided via `--template` for `starapp`
and `startproject` are used as-is, adding a warning that malicious or
poorly constructed templates may introduce security issues.
This commit is contained in:
Jake Howard 2025-09-04 11:53:51 +01:00 committed by nessita
parent c595af6545
commit 4e7a991c12
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/ref/django-admin.txt
View File

@ -1319,6 +1319,15 @@ zip files, you can use a URL like:
django-admin startapp --template=https://github.com/githubuser/django-app-template/archive/main.zip myapp
.. warning::
Templates provided via ``--template`` are used as is. Malicious or poorly
constructed templates may introduce security weaknesses or unintended
behavior. Compressed archives may also consume excessive resources during
extraction, potentially causing crashes or hangs.
Contents of templates should be carefully inspected before use.
.. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS
Specifies which file extensions in the app template should be rendered with the
@ -1412,7 +1421,10 @@ For example:
.. django-admin-option:: --template TEMPLATE
Specifies a directory, file path, or URL of a custom project template. See the
:option:`startapp --template` documentation for examples and usage.
:option:`startapp --template` documentation for examples and usage. The same
**security considerations** described for ``startapp`` templates apply here:
malicious or poorly constructed templates may introduce weaknesses or consume
excessive resources, and templates should be carefully inspected before use.
.. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS