From a096e4c4d78bab2d392af5b768eb4f87b9f4401c Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Fri, 19 Nov 2021 19:03:30 +0100 Subject: [PATCH] changesets: add changeset for secure templating Signed-off-by: Patrik Oldsberg --- .changeset/light-rabbits-matter.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/light-rabbits-matter.md diff --git a/.changeset/light-rabbits-matter.md b/.changeset/light-rabbits-matter.md new file mode 100644 index 0000000000..a528e4d1c5 --- /dev/null +++ b/.changeset/light-rabbits-matter.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-scaffolder-backend': patch +--- + +Switched to executing scaffolder templating in a secure context for any template based on nunjucks, as it is not secure by default (https://mozilla.github.io/nunjucks/api.html#user-defined-templates-warning).