Testing for legacy Angular JS remainders on instance

[Peter Wolbers]

As part of ServiceNow best practice, we want to set the glide.angular.legacy property to false to prevent older prepatched angular JS versions from being used and avoid attacks on vulnerabilities discovered in outdated Angular JS library versions, as described here:
https://www.servicenow.com/docs/bundle/yokohama-platform-security/page/administer/security-center/re...

Now I am wondering if there is a good way to search for outdated Angular JS libraries within the instance, besides going through records one by one.

Hopefully someone has already gone through this and can help me!

[Dom_Wolfenden]

While not a direct answer to your question I would recommend reading the "Description" and "AngularJS Configuration" sections of this ServiceNow Article:

ServiceNow Client-Side JavaScript Library Patching - Security

It will inform which libraries are effected when you make the change. Comparing the code of the “angular.min.js” and “angular-patched.min.js” libraries for version 1.5.11 as an example, 59% of it is identical and of the remaining most of the changes appear to relate to variable name changes, this will be to stop any attacks from functioning where there are hardcoded reverences to original variable names.

I suspect that within the OOTB configuration ServiceNow will have replaced any deprecated elements of pre 1.6.1* releases with alternative code. 

*Xanadu and later releases of ServiceNow use the following versions of AngularJS: 

1.2.20, 1.4.1, 1.5.0, 1.5.11, 1.6.1

I'm not aware of a tool that can be used to perform a search on an instance to locate code which was deprecated in version 1.6.1 though from the research I have carried out it seems that version 1.6.1 retains most of the features of 1.5.11 with the following deprecations:

• The success() and error() methods were deprecated in favour of using the then() method with promises.
• Support for self-closing tags in jqLite was removed to prevent potential XSS vulnerabilities.

So these are probably the elements you would need to search for. I would think that someone would be able to write a background script to search for these.