diff options
| author | Jake Howard <git@theorangeone.net> | 2025-09-04 11:53:51 +0100 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2025-09-04 13:38:31 -0300 |
| commit | fbced43cf84445e3770ce0a3744daca383813ad2 (patch) | |
| tree | 8e071ee246befc9dcd8b1db50ca31e5307656b19 /docs/ref | |
| parent | e2d83a2076ca3c7db31ddf8f56fef5af9208cdac (diff) | |
[5.2.x] Refs #36588 -- Warned about using external templates in startapp/startproject commands.
Clarified that custom templates provided via `--template` for `starapp`
and `startproject` are used as-is, adding a warning that malicious or
poorly constructed templates may introduce security issues.
Backport of 4e7a991c12a113229e0927974d3bf94ea04eecf6 from main.
Diffstat (limited to 'docs/ref')
| -rw-r--r-- | docs/ref/django-admin.txt | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/docs/ref/django-admin.txt b/docs/ref/django-admin.txt index 2e25dcc414..cb0c5febec 100644 --- a/docs/ref/django-admin.txt +++ b/docs/ref/django-admin.txt @@ -1303,6 +1303,15 @@ zip files, you can use a URL like: django-admin startapp --template=https://github.com/githubuser/django-app-template/archive/main.zip myapp +.. warning:: + + Templates provided via ``--template`` are used as is. Malicious or poorly + constructed templates may introduce security weaknesses or unintended + behavior. Compressed archives may also consume excessive resources during + extraction, potentially causing crashes or hangs. + + Contents of templates should be carefully inspected before use. + .. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS Specifies which file extensions in the app template should be rendered with the @@ -1391,7 +1400,10 @@ For example: .. django-admin-option:: --template TEMPLATE Specifies a directory, file path, or URL of a custom project template. See the -:option:`startapp --template` documentation for examples and usage. +:option:`startapp --template` documentation for examples and usage. The same +**security considerations** described for ``startapp`` templates apply here: +malicious or poorly constructed templates may introduce weaknesses or consume +excessive resources, and templates should be carefully inspected before use. .. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS |