Use the glide.ui.jelly.js_interpolation.protect property to ensure that any JavaScript about to be executed on a Jelly page is protected from injection with the help of Jelly interpolation.

When you set property to true, an application goes through a Jelly script tree (nested). It wraps potentially dangerous Jelly expressions with a filter that:
  • Escapes their results to be safe, or
  • If their safety can't be guaranteed, generates a SecurityException because the expression that was going to be evaluated represents a possible security issue.
Warning: This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

More information

Attribute Description
Property name glide.ui.jelly.js_interpolation.protect
Configuration type System Properties (/sys_properties_list.do)
Category Validation, sanitization, and encoding
Purpose To mitigate against malicious code execution attacks that can occur using Jelly Injection.
Recommended value true
Default value false
Security risk rating 9
Functional impact This property makes a best guess at whether an expression is quoted. It may wrongly quote legitimate expression. In that case manually marking an expression as safe may be necessary.
Security risk (Moderate) JEXL injection is a form of input injection unique to the ServiceNow AI Platform that can lead to both cross-site request forgery and code execution. Completely turning off the protection may potentially open many P1 security vulnerabilities.
Workaround

To manually mark an expression as safe add SAFE prefix to Jelly expression:

${SAFE:sysparm_input};

Blindly adding SAFE to each expression is the wrong way to approach the problem, because it may open a security vulnerability.
  • Only add SAFE to an expression if you can guarantee that the expression does not contain input from the client.
  • If it does, it's possible for a malicious client to cause evaluation of privileged JavaScript.
References Jelly tags

High Security Settings

To learn more about adding or creating a system property, see Add a system property.