Skip to content

Update template --allow-scripts help text with explicit trust warning and propagate localization source updates#54393

Open
Copilot wants to merge 3 commits into
release/10.0.4xxfrom
copilot/update-allow-scripts-message
Open

Update template --allow-scripts help text with explicit trust warning and propagate localization source updates#54393
Copilot wants to merge 3 commits into
release/10.0.4xxfrom
copilot/update-allow-scripts-message

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 20, 2026

This updates the TemplateCommand_Option_AllowScripts message in SymbolStrings.resx to include a clear security warning about arbitrary code execution via MSBuild. The localization source strings are regenerated so translation files track the new English source and require translation review.

  • Resource text update

    • Replaced the --allow-scripts description in:
      • src/Cli/Microsoft.TemplateEngine.Cli/Commands/SymbolStrings.resx
    • New text makes explicit that disabling this option does not eliminate arbitrary code execution risk from templates.
  • Localization propagation

    • Regenerated SymbolStrings.*.xlf under:
      • src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/
    • Updated <source> for TemplateCommand_Option_AllowScripts across locales.
    • Marked existing translations as needs-review-translation for this key.
<data name="TemplateCommand_Option_AllowScripts" xml:space="preserve">
  <value>Specifies if post action scripts should run. Templates can run arbitrary code through MSBuild whether or not this option is enabled; only use templates from trusted sources.</value>
</data>

Copilot AI and others added 3 commits May 20, 2026 21:09
Agent-Logs-Url: https://github.com/dotnet/sdk/sessions/d6c706a2-780f-4a16-8fb7-487d1890a91f

Co-authored-by: marcpopMSFT <12663534+marcpopMSFT@users.noreply.github.com>
This reverts commit fd3d70a.

Co-authored-by: marcpopMSFT <12663534+marcpopMSFT@users.noreply.github.com>
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the dotnet new template --allow-scripts option description to include an explicit security warning about arbitrary code execution via MSBuild, and propagates the updated English source string across localization files so translations are flagged for review.

Changes:

  • Expanded TemplateCommand_Option_AllowScripts help text in SymbolStrings.resx with an explicit trust warning.
  • Regenerated SymbolStrings.*.xlf so the updated <source> is reflected across locales.
  • Marked existing translations for the updated key as needs-review-translation.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/Cli/Microsoft.TemplateEngine.Cli/Commands/SymbolStrings.resx Updates the English help text for --allow-scripts with an explicit security warning.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.cs.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.de.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.es.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.fr.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.it.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.ja.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.ko.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.pl.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.pt-BR.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.ru.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.tr.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.zh-Hans.xlf Updates localization source string and marks translation as needing review.
src/Cli/Microsoft.TemplateEngine.Cli/Commands/xlf/SymbolStrings.zh-Hant.xlf Updates localization source string and marks translation as needing review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants