---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Disable Entity Expansion within the XMLDocument2 Streaming Parser

# Disable Entity Expansion within the XMLDocument2 Streaming Parser {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
If customizations do not require entity expansion, use the glide.stax.allow_entity_resolution property to completely disable external entity expansion. The XML completes parsing but doesn't include any
internal or external entities.
If the glide.stax.allow_entity_resolution is not set to the recommended value of false, then this property allow XML entities to be expanded during parsing by the streaming parser
(XMLDocument2).

Ensure that the property glide.stax.allow_entity_resolution exists in the System Properties \[sys_properties\] table and is set to false. If the property does not appear in the System
Properties \[sys_properties\] table the default value is true.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-disable-entity-expansion__section_wc1_cqn_phc}

{#sc-disable-entity-expansion__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name |   |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | true |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 9.0 * CVSS rating: Critical * Security risk details: XML entity expansion can lead to attacks such as ability to read system files, and Denial of Service. {#sc-disable-entity-expansion__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | Before setting this property: * Set the glide.xml.entity.whitelist.enabled and glide.stax.whitelist_enabled properties to true. To learn more, see [Restrict XML external entities](https://www.servicenow.com/docs/XARj9HMYYn7jTeCnk3VVJg "Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks.") and [Require XMLdoc2 entity validation with allowlist](https://www.servicenow.com/docs/rLaoU9QMqTnmTcaXcv02Dg "If customizations do not require entity expansion, use the glide.xmlutil.max_entity_expansion property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities."). * Define a listing of comma-delimited FQDN in the glide.xml.entity.whitelist property, which is the only URLs that can be reached using XML Entity processing. property. To learn more, see [Restrict XML external entities](https://www.servicenow.com/docs/XARj9HMYYn7jTeCnk3VVJg "Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks."). {#sc-disable-entity-expansion__ul_dzh_dmg_p3c} |
[ ]

{#sc-disable-entity-expansion__table_ajc_b43_3kb}