Input validation (instance security hardening)

The ServiceNow AI Platform performs input validation to prevent issues that result from the entry of malformed data.

This section describes security controls within the ServiceNow AI Platform that an administrator can configure to minimize entry of malformed data, regardless of source. These sources include manual user entry, or from an infrastructure, external entities, or database systems.

• Allow embedded HTML code (instance security hardening)
  Use the glide.ui.security.allow_codetag property to disable support for embedding HTML code created using the [code] tag.
• Allow JavaScript tags in embedded HTML (instance security hardening)
  The glide.ui.security.codetag.allow_script property disables support for embedding HTML JavaScript code created using of the [code] tag.
• Check Unsanitized Html (instance security hardening)
  Use the com.glide.security.check_unsanitized_html property to enforce sanitization behavior of translated_html fields on a global level for field assignments.
• Client generated scripts sandbox (instance security hardening)
  Use the glide.script.use.sandbox property to enable script sandboxing.
• Enable AJAXEvaluate (instance security hardening)
  Use the glide.script.allow.ajaxevaluate property to restrict arbitrary client script execution using the system API on the server side.
• Escape Excel formula (instance security hardening)
  Use the glide.export.escape_formulas property to prevent Excel Injection, also, known as formula injection.
• Escape HTML (instance security hardening)
  Use the glide.ui.escape_html_list_field property to force HTML escapes for HTML fields in a list view.
• Escape JavaScript (instance security hardening)
  Use the glide.html.escape_script property to force escape from JavaScript (<script></script>) tags in HTML fields during list views.
• Escape Jelly (instance security hardening)
  Use the glide.ui.escape_all_script property to force escape of all scripts injected into Jelly.
• Escape XML (instance security hardening)
  The glide.ui.escape_text property forces escape of XML values at the parser level before transmitting them to the client's browser.
• HTML sanitizer (instance security hardening)
  Use the glide.html.sanitize_all_fields property to enable the HTMLSanitizer script include, which sanitizes HTML input based on exclusion listed and inclusion listed attributes configured in a script.
• Jelly/JS interpolation (instance security hardening)
  Use the glide.ui.jelly.js_interpolation.protect property to ensure that any JavaScript about to be executed on a Jelly page is protected from injection with the help of Jelly interpolation.
• SOAP request strict security (instance security hardening)
  Use the glide.soap.strict_security property to enforces web service security.

Related reference

• Access control (instance security hardening)
• Attachments (instance security hardening)
• Email security (instance security hardening)
• Secure communications (instance security hardening)
• Security best practices (instance security hardening)
• Security inclusion list (instance security hardening)
• Session management (instance security hardening)
• Other settings and security resources