{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41605,"path":"platform-security/instance-security-hardening-settings/validation-sanitization-encoding.md","title":"Validation, sanitization, and encoding","bundle":null,"doc_type":null,"release":"australia","body":"\n# Validation, sanitization, and encoding\n\nValidation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting \\(XSS\\), SQL injection and other attacks.\n\nThis control ensures input validation and output encoding are in place and correctly configured, such as encoding or escaping output data. This category also includes checks for items such as deserialization of objects and positive validation through allow lists.\n\n-   **[Allow HTML Links to Trusted Domains in the Description Fields of the Impact Workspace Module \\[New in Security Center 7.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-allow-html-links-to-trusted.md)**  \nUse a system property to help sanitize the HTML allowed in the descriptions fields. This property limits the allowed links to only those from the trusted domains listed in the property.\n-   **[Enable the hardened java security manager](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-the-hardened-java-security-manager.md)**  \nThe **glide.security.manager** property contains the Java classname of the current Java security manager.\n-   **[Enable HTML Sanitizer \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-html-sanitizer.md)**  \nUse the **glide.html.sanitize\\_all\\_fields** property to enable the HTMLSanitizer script include, which sanitizes HTML input based on exclusion listed and inclusion listed attributes configured in a script.\n-   **[Enable script sandbox \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-client-generated-scripts-sandbox.md)**  \nUse the **glide.script.use.sandbox** property to enable script sandboxing.\n-   **[Enforce HTML Sanitization](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-check-unsanitized-html.md)**  \nUse the **com.glide.security.check\\_unsanitized\\_html** property to enforce sanitization behavior of translated\\_html fields on a global level for field assignments.\n-   **[Ensure Contextual Search Do Not Contain An Unvalidated Redirect \\[New in Security Center 7.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-ensure-contextual-search-do-not-contain-an-unvalidated-redirect.md)**  \nPrevent Contextual Search results from containing referral links outside the current domain with a system property.\n-   **[Disable AJAXEvaluate](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-ajaxevaluate.md)**  \nUse the **glide.script.allow.ajaxevaluate** to protect the system API from vulnerabilities of Client script execution through AJAX calls.\n-   **[Disable Entity Expansion within the XMLDocument2 Streaming Parser](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-entity-expansion.md)**  \nIf customizations do not require entity expansion, use the **glide.stax.allow\\_entity\\_resolution** property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.\n-   **[Disable external content URL](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-external-content-url.md)**  \nManage how external link metadata is used in your instance with Connect Chat.\n-   **[Disable JavaScript tags in embedded HTML](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-allow-javascript-tags-in-embedded-html.md)**  \nUse the **glide.ui.security.codetag.allow\\_script** property to disable support for embedding HTML JavaScript code created using of the \\[code\\] tag.\n-   **[Disable embedded HTML code \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-allow-embedded-html-code.md)**  \nUse the **glide.ui.security.allow\\_codetag** property to disable support for embedding HTML code created using the \\[code\\] tag.\n-   **[Restrict downloadable MIME types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-downloadable-mime-type-denylist.md)**  \nThe **glide.ui.attachment.download\\_mime\\_types** property will force the specified list of dangerous file types to be downloaded to the client and not viewed inline in the browser.\n-   **[Enable HTML Sanitizer within Virtual Agent](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-html-sanitizer.md)**  \nUse the **com.glide.cs.html.sanitizer.enabled** property to enable HTMLSanitizerService.\n-   **[Enable Jelly JS Interpolation Protection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-jelly-js-interpolation-protection.md)**  \nUse the **glide.ui.jelly.js\\_interpolation.protect** property to ensure that any JavaScript about to be executed on a Jelly page is protected from injection with the help of Jelly interpolation.\n-   **[Enable Jelly JS interpolation protection for nested expressions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-jelly-js-interpolation-protection-for-nested-expressions.md)**  \nManage the interpolation protection on your instance.\n-   **[Enforce relative links](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-relative-links.md)**  \nUse the **glide.cms.catalog\\_uri\\_relative** property to enforce relative links from the URI parameter on `/ess/catalog.do`.\n-   **[Enforce URL allowlist check](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-url-allowlist-check.md)**  \nUse the **glide.security.url.whitelist** system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.\n-   **[Escape Excel formulas \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-escape-excel-formula.md)**  \nUse the **glide.export.escape\\_formulas** property to prevent Excel Injection, also, known as formula injection.\n-   **[Escape HTML in list views \\[Updated in Security Center 1.3 and 1.5\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-escape-html.md)**  \nUse the **glide.ui.escape\\_html\\_list\\_field** property to force HTML escapes for HTML fields in a list view.\n-   **[Escape JavaScript \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-escape-javascript.md)**  \nUse the **glide.html.escape\\_script** property to force escape from JavaScript \\(`<script></script>`\\) tags in HTML fields during list views.\n-   **[Escape jelly script \\[Updated in Security Center 1.3 and 1.5\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-escape-jelly.md)**  \nUse the **glide.ui.escape\\_all\\_script** property to force escape of all scripts injected into Jelly.\n-   **[Escape scripts in scratchpad](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-escape-scratchpad.md)**  \nLearn how scratchpad factors into the security posture of your instance and how to manage it so that malicious scripts can't be executed on it.\n-   **[Escape XML markup](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-escape-xml.md)**  \nUse the **glide.ui.escape\\_text** property to force escape of XML values at the parser level before transmitting them to the client's browser.\n-   **[Escape xml response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-escape-xml-response.md)**  \nManage how XML escapes are handled on your instance.\n-   **[Restrict access to GlideSystemUserSession scriptable API](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-access-glidesystemusersession-scriptable-api.md)**  \nThe client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession's addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call this method via script.\n-   **[Restrict allowed Java packages \\[Updated in Security Center 1.3\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-java-packages-allowlist.md)**  \nConfiguring these properties protect from dangerous APIs being exposed to the scripting engine.\n-   **[Unset LDAP Initial distinguished name \\[Updated in Security Center 1.3 and removed in 2.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-ldap-initial-distinguished-name.md)**  \nUse this property to manage the distinguished name of a LDAP Server record.\n-   **[Enforce strict security of session cookies](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-secure-session-cookies.md)**  \nUse the **glide.ui.secure\\_cookies** property to require properly formatted cookies\n-   **[Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-setting-entity-expansion-threshold.md)**  \nUse the **glide.xmlutil.max\\_entity\\_expansion** property to change the maximum entity expansion limit to a smaller number.\n-   **[Prevent Empty ACL Creation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-prevent-empty-acl-creation.md)**  \nSet the **glide.security.empty\\_acl.popup\\_window.enabled** property to the secure value of true to block attempts to create, update, or save an invalid ACL. This setting will also provide a client-side model to configure a role or security attribute for the ACL.\n-   **[Prevent Reuse of REST API Sessions in UI/Web](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-prevent-reuse-of-rest-api-sessions-in-ui-web.md)**  \nPrevent REST API session cookies from bypassing Single Sign-On \\(SSO\\) and Multi-Factor Authentication \\(MFA\\) controls using a system property.\n-   **[Define restricted downloadable MIME types \\[Updated in Security Center 1.3, 1.5, and 2.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-downloadable-mime-types.md)**  \nUse the **glide.ui.attachment.force\\_download\\_all\\_mime\\_types** property to download MIME types and not to render inline in the browser.\n-   **[Restrict uploaded MIME types](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-upload-mime-type-restriction.md)**  \nUse the **glide.security.file.mime\\_type.validation** property to activate MIME type checking for uploads. You can enable \\(set the property to **true**\\) or disable \\(set it to **false**\\) MIME type validation for file attachments.\n-   **[Restrict XML external entities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xml-entity-validation-url-allowlist.md)**  \nConfigure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity \\(XXE\\) attacks.\n-   **[Require XMLdoc2 entity validation with allowlist](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xmldoc2-entity-validation-with-entity-expansion.md)**  \nIf customizations do not require entity expansion, use the **glide.xmlutil.max\\_entity\\_expansion** property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.\n-   **[Sanitize All Translated HTML Fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-sanitize-all-translated-html-fields.md)**  \nLearn how to configure the **glide.translated\\_html.sanitize\\_all\\_fields** property to the secure value to ensure that all **translated\\_html** elements are sanitized with an HTML sanitizer.\n-   **[Sanitize HTML in the Description Fields of the Impact Workspace Module \\[New in Security Center 7.0\\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sanitize-html-in-the-description-fields-of-the-impact-workspace-module.md)**  \nSanitize the HTML in the description fields by removing HTML tags that are sources of HTML injection attacks with the **sn\\_impact\\_common.blacklist\\_tags\\_HTML\\_injection** property.\n-   **[Set safe content security policy for SVG files](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-set-safe-content-security-policy-for-svg-files.md)**  \nThe **com.glide.csp.self\\_script\\_src\\_svg** property adds the **script-src none** directive to the HTTP Content-Security-Policy header when Scalable Vector Graphics \\(SVGs\\) are accessed through the Translation Memory Index \\(IIX\\) file extension.\n-   **[Validate MIME Type for Multi-Extension Filenames, Polyglot Files, and Null-Byte Injection](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-validate-mime-type-for-multi.md)**  \nUse a system property to prevent attachments from bypassing MIME-type restrictions.\n\n**Parent Topic:**[Hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/security-hardening-settings.md)\n\n"}}