Escape XML markup [Updated in Security Center 1.3]

  • リリースバージョン: Australia
  • 更新日 2026年03月12日
  • 所要時間：4分

    • Use the glide.ui.escape_text property to force escape of XML values at the parser level before transmitting them to the client's browser.

    Cross-site scripting occurs when an attacker injects malicious JavaScript into an entry point. The platform/application fails to escape the malicious JavaScript before transmitting it to the victim's browser for execution. Escaping in this context means the following:
    • & --> &
    • < --> &lt;
    • > --> &gt;
    • " --> &quot;
    • ' --> &#x27;
    • / --> &#x2F;

    Example: <script>alert('XSS Attack');</script>

    Escaping: &lt;script&gt;alert(&#39;XSS Attack&#39;);&lt;/script&gt;

    Ensure the glide.ui.escape_text property exists in the sys_properties table and is set to true.

    警告:
    This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

    More information

    Attribute Description
    Property name glide.ui.escape_text
    Configuration type System Properties (/sys_properties_list.do)
    Category Validation, sanitization, and encoding
    Purpose Escaping XML ensures that browsers do not parse the malicious JavaScript embedded in untrusted data, and execute it as JavaScript.
    • A malicious user may try XSS attack to either hijack other users' session or redirect the user to a malicious website.
    • The NOW Platform contains code to secure cookies, but escaping it relies on this property being set to true.
    Recommended value true
    Security risk rating 8.8
    Functional impact This remediation enforces XML encoding at the XML parser level on the UI. It renders the encoded results for the user, which can have a functionality impact based on the instance user interaction with the resulted data.
    Security risk (High) Input validation must occur on the application to defend against cross-site scripting attacks. These attacks enable foreign scripts to execute on user session in the logged in browser's context. Attackers can use it to steal session information and sensitive data.
    Workaround

    After you set this property to true, rendering stops on the HTML tags in the catalog item description or in the catalog item variable help text. You may not be able to use HTML formatting for some fields.

    However, if the glide.ui.escape_text property is turned of, all JEXL expressions would be prefixed with an output encoder:

    $⁠{JS:expression}

    $⁠{HTML:expression}

    or

    $⁠{JS,HTML:expression}