Sanitizing non HTML field

[PavelP]

We are trying to sanitze feedback from web page, that is comming into a Comment field (string). The documentation mentiones the html_sanitize attribute can be used on all fields to fix that, however still after activating the attribute in dictionary, the field triggers unwanted code.

Am I missing some steps, or will it be necessary to change format of the field?

Thanks for your help.

[Alex Cox]

Hi PavelP,

Could you please described the unwanted effect in a little more detail? 

In case it helps, here is some additional documentation on the HTML Sanitizer at the instance level:

https://docs.servicenow.com/bundle/london-platform-administration/page/administer/security/concept/c_HTMLSanitizer.html

Note that there are lower level pages that show how to configure the behavior.

Alex

[PavelP]

Currently, we use as unwanted effect for testing onmouseover link. Onmouseover is under blacklisted attributes, but the link is still functional.

[Alex Cox · Accepted solution]

Hi Pavel,

I played around in my dev instance a bit and I believe the documentation may be incorrect - specifically the part that it can be on any kind of field.  When I went into the dictionary entry for a string field and added the html_sanitize attribute - the record for the html_sanitize attribute itself explicitly stated that it is only applicable to HTML and Translated HTML fields in the "Applies to description" field.

I'll pass this discrepancy along as a Problem on HI. Either way - one of the two areas is incorrect.

In any event, I might suggest using a Business Rule to parse that field as it is updated, and remove any undesired tags.

Best of luck!

Alex

[PavelP]

Okay, good to know. Thanks so much for your help.

Can you please post here the number of HI ticket, or its result.