Skip to content

Conversation

marcpopMSFT
Copy link
Member

@marcpopMSFT marcpopMSFT commented Oct 10, 2025

Added a warning about untrusted .NET templates.

Summary

We wanted to make sure customers knew that installing and running untrusted templates came with risk. Let me know if I should update the dotnet new install documentation as well.


Internal previews

📄 File 🔗 Preview link
docs/core/tools/custom-templates.md docs/core/tools/custom-templates
docs/core/tools/dotnet-new-install.md docs/core/tools/dotnet-new-install

Added a warning about untrusted .NET templates.
@Copilot Copilot AI review requested due to automatic review settings October 10, 2025 17:23
@marcpopMSFT marcpopMSFT requested a review from a team as a code owner October 10, 2025 17:23
@dotnetrepoman dotnetrepoman bot added this to the October 2025 milestone Oct 10, 2025
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a security warning to inform users about the risks of installing and running untrusted .NET templates. The warning explains that templates can execute MSBuild code, making them potentially dangerous if they come from untrusted sources.

  • Added a warning callout about security risks of untrusted templates

@marcpopMSFT marcpopMSFT requested a review from blowdart October 10, 2025 17:24
Copy link
Contributor

@meaghanlewis meaghanlewis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@marcpopMSFT thanks for this PR! I left a warning style and wording change update for you.

And yes, please feel free to update the dotnet new install documentation too.

@blowdart
Copy link
Contributor

I would be more formal than @meaghanlewis suggested with

Templates can run MSBuild code when triggered, do not install or run untrusted .NET templates.

(italics to highlight my wording change, not for the final edit)

@marcpopMSFT
Copy link
Member Author

Thank you both. I used blowdart text. I also added it to the dotnet new install documentation as well. I put it up near the top where it's less likely to be missed. I thought about putting it at the bottom or the end of the description section but was worried it would blend in too much. Thoughts on where I put it on that doc, @meaghanlewis ?

marcpopMSFT and others added 2 commits October 13, 2025 16:28
Co-authored-by: Meaghan Osagie (Lewis) <mosagie@microsoft.com>
Reinstate warning about untrusted .NET templates.
@meaghanlewis
Copy link
Contributor

@marcpopMSFT thanks for the updates!

@meaghanlewis meaghanlewis merged commit 88ba524 into main Oct 14, 2025
10 checks passed
@meaghanlewis meaghanlewis deleted the marcpopMSFT-patch-1 branch October 14, 2025 00:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants