From 761347aa635e14bf7a937e88d45a40e671d325c5 Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Mon, 11 May 2026 16:45:49 -0600 Subject: [PATCH] templates: Explicitly warn about misconfigurations --- modules/caddyhttp/templates/templates.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/modules/caddyhttp/templates/templates.go b/modules/caddyhttp/templates/templates.go index f1f910857..caac85b8a 100644 --- a/modules/caddyhttp/templates/templates.go +++ b/modules/caddyhttp/templates/templates.go @@ -36,13 +36,22 @@ func init() { // Templates is a middleware which executes response bodies as Go templates. // The syntax is documented in the Go standard library's // [text/template package](https://golang.org/pkg/text/template/). +// Note that ANY response body that matches and qualifies may be evaluated, +// even if it comes from a proxied backend. // -// ⚠️ Template functions/actions are still experimental, so they are subject to change. +// ⚠️ Template functions/actions can access the environment, files on disk, +// and make HTTP requests. This is extremely useful, but you need to make +// sure templates are only evaluated on content that you trust, control, or +// at least sanitize properly. // -// Custom template functions can be registered by creating a plugin module under the `http.handlers.templates.functions.*` namespace that implements the `CustomFunctions` interface. +// ⚠️ Templates are still experimental, so they are subject to change. // // [All Sprig functions](https://masterminds.github.io/sprig/) are supported. // +// Custom template functions can be registered by creating a plugin module +// under the `http.handlers.templates.functions.*` namespace that implements +// the `CustomFunctions` interface. +// // In addition to the standard functions and the Sprig library, Caddy adds // extra functions and data that are available to a template: //