templates: Explicitly warn about misconfigurations

Matthew Holt committed May 11, 2026 at 16:45 UTC 761347aa635e14bf7a937e88d45a40e671d325c5

1 file changed +11 -2

modules/caddyhttp/templates/templates.go

+11 -2

@@ -36,13 +36,22 @@ func init() {

36 // Templates is a middleware which executes response bodies as Go templates.

37 // The syntax is documented in the Go standard library's

38 // [text/template package](https://golang.org/pkg/text/template/).

39 +// Note that ANY response body that matches and qualifies may be evaluated,

40 +// even if it comes from a proxied backend.

41 //

40 -// ⚠️ Template functions/actions are still experimental, so they are subject to change.

42 +// ⚠️ Template functions/actions can access the environment, files on disk,

43 +// and make HTTP requests. This is extremely useful, but you need to make

44 +// sure templates are only evaluated on content that you trust, control, or

45 +// at least sanitize properly.

46 //

42 -// Custom template functions can be registered by creating a plugin module under the `http.handlers.templates.functions.*` namespace that implements the `CustomFunctions` interface.

47 +// ⚠️ Templates are still experimental, so they are subject to change.

48 //

49 // [All Sprig functions](https://masterminds.github.io/sprig/) are supported.

50 //

51 +// Custom template functions can be registered by creating a plugin module

52 +// under the `http.handlers.templates.functions.*` namespace that implements

53 +// the `CustomFunctions` interface.

54 +//

55 // In addition to the standard functions and the Sprig library, Caddy adds

56 // extra functions and data that are available to a template:

57 //