-
Notifications
You must be signed in to change notification settings - Fork 6k
Add warning for untrusted .NET templates #49074
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Added a warning about untrusted .NET templates.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds a security warning to inform users about the risks of installing and running untrusted .NET templates. The warning explains that templates can execute MSBuild code, making them potentially dangerous if they come from untrusted sources.
- Added a warning callout about security risks of untrusted templates
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@marcpopMSFT thanks for this PR! I left a warning style and wording change update for you.
And yes, please feel free to update the dotnet new install documentation too.
I would be more formal than @meaghanlewis suggested with Templates can run MSBuild code when triggered, do not install or run untrusted .NET templates. (italics to highlight my wording change, not for the final edit) |
Thank you both. I used blowdart text. I also added it to the |
Co-authored-by: Meaghan Osagie (Lewis) <mosagie@microsoft.com>
Reinstate warning about untrusted .NET templates.
@marcpopMSFT thanks for the updates! |
Added a warning about untrusted .NET templates.
Summary
We wanted to make sure customers knew that installing and running untrusted templates came with risk. Let me know if I should update the dotnet new install documentation as well.
Internal previews