---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Define restricted downloadable MIME types

# Define restricted downloadable MIME types {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.ui.attachment.force_download_all_mime_types property to download MIME types and not to render inline in the browser.
If the glide.ui.attachment.download_mime_types property doesn't include dangerous MIME types such as text/html, image/svg, image/svg+xml, application/xml, and application/xhtml+xml, then those dangerous
files could be rendered inline in the browser, which could lead to Cross-Site Scripting (XSS) attacks.

This property is a comma-separated list of attachment MIME types that are downloaded to the client and don't render inline in the browser. For example, including text/html forces HTML files to be downloaded to the client as
attachments rather than viewed inline in the browser. Maintaining this list properly by including all dangerous MIME types prevents Cross-Site Scripting attacks.  
Note:  
This property's protection is only relevant when the glide.ui.attachment.force_download_all_mime_types property is set to false.

If the glide.ui.attachment.force_download_all_mime_types is set to false, verify that the glide.ui.attachment.download_mime_types system property includes the
dangerous MIME types <kbd class="ph userinput">text/html,image/svg,image/svg+xml,application/xml</kbd>.

## More information {#sc-downloadable-mime-types__section_qhx_1b1_xwb}

{#sc-downloadable-mime-types__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.attachment.force_download_all_mime_types |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String (Comma-separated list of MIME types) |
| Recommended value | text/html,image/svg,image/svg+xml,application/xml,application/xhtml+xml |
| Default value | text/html,image/svg,image/svg+xml,application/xml,application/xhtml+xml |
| Fallback value | '' |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 6.3 * CVSS score: Medium * Security Risk: Maintaining this list properly can prevent cross site scripting attacks. {#sc-downloadable-mime-types__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | This check is only relevant when the glide.ui.attachment.force_download_all_mime_types is set to false or doesn't exist in the System Properties \[sys_properties\] table. |
[ ]

{#sc-downloadable-mime-types__table_ajc_b43_3kb}