Convert inbound email HTML (instance security hardening)

Use the glide.email.inbound.convert_html_inline_attachment_references property to specify whether to convert inbound email HTML so email images appear in the email HTML body preview.

The following happens when the glide.email.inbound.convert_html_inline_attachment_reference system property is set to false:

• In the ServiceNow AI Platform, broken cid (content ID) links appear in place of images received. The format in which the email image appears depends on the property setting at the time the email is received, not the current property setting.
• The ‘malicious’ content received in the attachment isn't referenced in the HTML in the email. The attachment itself is stored in the sys_attachment table.
• Inbound email processing won't update the email's HTML data to reflect the stored location of the attachment in the sys_attachment table. This results in the following:
  • Inline images don't appear in email display in the activity formatter.
    Note:

    To resolve this issue with activity formatter, first check to see if no security concerns exist. Then set the glide.email.inbound.convert_html_inline_attachment_reference system property totrue to enable future emails received to contain the necessary HTML URL to reference the image. Changing the property doesn't update emails already received. The new value affects only inbound emails received after changing the property.
  • Inline images don't appear when the email is viewed in the email HTML preview.
  • When appending email.body_htm in inbound actions between code tags, the images are missing.

Prerequisites

Before setting this property, set the glide.email.read.active property to true. To learn more, see Enable using your own POP3 server.

More information

Attribute	Description
Property name	glide.email.inbound.convert_html_inline_attachment_references
Configuration type	System Properties (/sys_properties_list.do)
Configure in Instance Security Center	Yes
Purpose	To restrict image rendering in HTML body preview.
Recommended value	false
Functional Impact	Once this property is configured, user are not able to see the image preview in the email body.
Security risk	(Medium) If the property is not enabled, an attacker might send malicious image containing malware.
References	Email properties Inbound mail configuration

To learn more about adding or creating a system property, see Add a system property.