---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set safe content security policy for SVG files

# Set safe content security policy for SVG files {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The com.glide.csp.self_script_src_svg property adds the script-src none directive to the HTTP Content-Security-Policy header when Scalable Vector Graphics (SVGs) are accessed through
the Translation Memory Index (IIX) file extension.
The com.glide.csp.self_script_src_svg system property adds script-src none to the Content-Security-Policy header when SVGs are accessed via the IIX file extension. This prevents the
exploitation of stored XSS from crafted file attachments stored within the instance.

Ensure that the property com.glide.csp.self_script_src_svg is set to true.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-set-safe-content-security-policy-for-svg-files__section_qhx_1b1_xwb}

{#sc-set-safe-content-security-policy-for-svg-files__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.csp.self_script_src_svg |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 7.1 * CVSS score: High * Security risk details: Without this policy, attackers can inject malicious JavaScript that users unknowingly execute, leading to data exfiltration or session takeover. {#sc-set-safe-content-security-policy-for-svg-files__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| Functional impact | This property prevents scalable vector graphics (SVG) files from accessing external scripts. |
[ ]

{#sc-set-safe-content-security-policy-for-svg-files__table_ajc_b43_3kb}