---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set safe content security policy for SVG files

# Set safe content security policy for SVG files {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
The com.glide.csp.self_script_src_svg property adds the script-src none directive to the HTTP Content-Security-Policy header when Scalable Vector Graphics (SVGs) are accessed through
the Translation Memory Index (IIX) file extension.
The com.glide.csp.self_script_src_svg system property adds "script-src none" to the Content-Security-Policy header when SVGs are accessed via the ".iix" file extension. This prevents the exploitation of stored
XSS from crafted file attachments stored within the instance.

Verify that the property com.glide.csp.self_script_src_svg is set to true.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-set-safe-content-security-policy-for-svg-files__section_qhx_1b1_xwb}

{#sc-set-safe-content-security-policy-for-svg-files__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.csp.self_script_src_svg |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | \<none\> |
| Fallback value | false |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/qvFon3mPY~i4OtLtQVS_QQ "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 7.1 * CVSS score: High * Security risk details: Without this policy, attackers can inject malicious JavaScript that users unknowingly execute, leading to data exfiltration or session takeover. {#sc-set-safe-content-security-policy-for-svg-files__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| Functional impact | This property prevents scalable vector graphics (SVG) files from accessing external scripts. |
[ ]

{#sc-set-safe-content-security-policy-for-svg-files__table_ajc_b43_3kb}