Merge pull request #33043 from backstage/optionally-allow-mkdocs-keys

Add `dangerouslyAllowAdditionalKeys` option for TechDocs MkDocs configuration
2026-02-27 14:58:09 -05:00
parent 32cb991728 2e20bf20d7
commit 790de54a85
6 changed files with 119 additions and 3 deletions
@@ -64,6 +64,18 @@ export interface Config {
         * List of mkdocs plugins which should be added as default to all mkdocs.yml files.
         */
        defaultPlugins?: string[];
+
+        /**
+         * List of additional MkDocs configuration keys to allow beyond
+         * the default safe allowlist. This can introduce security vulnerabilities.
+         *
+         * WARNING: Some MkDocs configuration keys can execute arbitrary code. For example, the
+         * 'hooks' key allows running arbitrary Python code during documentation generation.
+         * Only use this in trusted environments where all mkdocs.yml files are audited.
+         *
+         * @see https://www.mkdocs.org/user-guide/configuration/#hooks
+         */
+        dangerouslyAllowAdditionalKeys?: string[];
      };
    };