Enabling HTML Sanitizer in ServiceNow

[Rajeev ponuguma]

Hello All,

We have a requirement to enable HTML Sanitizer , Can someone help me with the steps to enable it and also what will be the impact on existing date once we enable HTML sanitizer ?

how can we test in real time that HTML sanitization is working ?

[Daniel Borkowi1]

Hi @Rajeev ponuguma , you only need to set the System Properties: glide.html.sanitize_all_fields and glide.translated_html.sanitize_all_fields to true. 

The impact is, that within html fields some tags and attributes are filtered or restricted: e.g. usage of protocols in links. Also tags like <script> are removed. You can configure black and whitelists  in  Script Include HTMLSanitizerConfig. So users are not allowed to enter dangerous HTML code into HTML fields.

To test it, you can use any record with HTML field - change in this field to Source code (button <>) and enter tags like script. After saving the record you will see that this tag is removed.

Everything is documented here: https://docs.servicenow.com/bundle/vancouver-platform-security/page/administer/security/concept/c_HT...

Greets
Daniel

Please mark reply as Helpful/Correct, if applicable. Thanks!

[Rajeev ponuguma]

Hello Daniel, 

Thank you so much for your reply .

I can see that we have OOTB script include 'HTMLSanitizerConfig' with below script. can you please confirm do we need to  configure black and whitelists ? or only enabling properties will restrict the tags without modifying the script include? 

var HTMLSanitizerConfig = Class.create();

HTMLSanitizerConfig.prototype = {

    initialize: function() {

    },

    HTML_WHITELIST : {

        globalAttributes: {

            attribute:[],

            attributeValuePattern:{}

        },

    },

    HTML_BLACKLIST : {

        globalAttributes: {},

    },

    getWhiteList : function() {

        return this.HTML_WHITELIST;

    },

    getBlackList : function() {

        return this.HTML_BLACKLIST;

    },

    type: 'HTMLSanitizerConfig'

};

[Daniel Borkowi1 · Accepted solution]

Hi @Rajeev ponuguma , you only need to adjust Blacklist and Whitelist if you want to extend the OOTB filters. For the standard use cases it's not needed. Here you can read what is already included: Exploring HTML sanitizer 

Greets
Daniel

Please mark reply as Helpful/Correct, if applicable. Thanks!