---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security
Release :
- zurich
ft:locale :
- en-US
ft:publication_title :
- Zurich Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Disable embedded HTML code \[Updated in Security Center 1.3\]
# Disable embedded HTML code \[Updated in Security Center 1.3\] {#ariaid-title1}
Release version: Zurich
Updated May 15, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Disable embedded HTML code \[Updated in Security Center 1.3\]
This feature involves theglide.ui.security.allowcodetagsystem property, which controls the support for embedding HTML code using the \[code\] tag in journal fields and forms within your ServiceNow instance.
The \[code\] tag can render HTML, which poses a risk of cross-site scripting (XSS) attacks.
These attacks allow malicious scripts to execute in a user's browser session, potentially stealing session information and sensitive data.
Show full answer Show less
## Key Features
* **Disable HTML rendering:** Setting **glide.ui.security.allowcodetag** to **false** completely disables rendering of HTML embedded via \[code\] tags, forcing journal fields to display raw HTML tags instead of rendered content.
* **Script execution control:** If disabling the property disrupts functionality---for example, if your instance relies on HTML rendering in journal fields---you can keep **glide.ui.security.allowcodetag** set to **true** but set **glide.ui.security.codetag.allowscript** to **false**. This disables script execution within \[code\] tags while still allowing HTML rendering.
* **Security considerations:** Disabling script execution reduces but does not eliminate risk, as it relies on sanitizing known script conventions rather than prohibiting HTML entirely.
* **ServiceNow AI Platform protection:** The platform applies escaping and encoding techniques that prevent users from submitting HTML formatted inputs in journal fields; however, journal fields can still render text enclosed in \[code\] tags as HTML, which requires this additional control.
## Key Outcomes
* **Improved security posture:** Disabling HTML rendering or script execution in journal fields greatly reduces the risk of XSS attacks, protecting user sessions and sensitive data.
* **Potential impact on functionality:** Turning off HTML rendering may display raw HTML tags in journal fields, which could affect how users interact with data or certain features.
* **Configurable balance:** ServiceNow customers can choose between complete HTML rendering prohibition or limited HTML rendering without script execution to balance security and functionality based on their needs.
* **Manageable via Instance Security Center:** These properties can be configured in the Security Center, under validation, sanitization, and encoding settings.
Use the glide.ui.security.allow_codetag property to disable support for embedding HTML code created using the \[code\] tag.
Disable support for displaying HTML code embedded using the `[code]` tag. This tag allows rendered HTML to display in journal fields and may lead to cross-site scripting (XSS) attacks. These attacks can enable
foreign scripts to execute on a user session in the logged in browser's context. Attackers can use these scripts to steal session information and sensitive data. The HTML language was not designed to separate script from formatting,
so allowing user-controlled HTML in any system has inherent risk.
If setting glide.ui.security.allow_codetag to false disrupts instance functionality, for example, if your instance uses a feature that relies on HTML rendering in journal fields, you can
maintain a compliant security posture by keeping glide.ui.security.allow_codetag set to true and setting glide.ui.security.codetag.allow_script to
false. This change disables script execution within `[code]` tags while preserving HTML rendering. Note that this approach carries some residual risk, as it relies on sanitizing all known
script conventions within HTML rather than prohibiting HTML code tags entirely.
Set the glide.ui.security.allow_codetag system property to false to completely prohibit journal fields and forms from displaying rendered HTML.
The ServiceNow AI Platform mitigates many injection and cross-site attacks by implementing escaping and encoding techniques. As a result, users can't write/submit HTML formatted inputs for journal fields. But journal fields can render text enclosed within code tags as HTML.
* However, there is an associated security risk. If set to true, malicious users can write harmful HTML JS code that may be executed on a different client browser after rendering of journal fields.
* Set this property to false so that administrators can prevent journal fields from rendering HTML code by disabling support for the `[code]` tag.
{#sc-allow-embedded-html-code__ul_alw_3yq_nkb}
## More information {#sc-allow-embedded-html-code__section_more_information}
{#sc-allow-embedded-html-code__table_ajc_b43_3kb__entry__2}
| Attribute | Description |
|-|-|
| Property name | glide.ui.security.allow_codetag |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/EGuLOJWeGM7NY~gTADvUOw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Configure in Instance Security Center | Yes |
| Purpose | Protect against cross-site scripting and malicious script execution |
| Recommended value | false |
| Default value | true |
| Security risk rating | 4.2 |
| Functional impact | This remediation enforces HTML encoding to occur on the UI and renders the encoded results to the user. This property is set to true by default. In this state, your instance displays rendered HTML in journal fields and forms. If this property is set to false, HTML is not rendered properly and HTML tags may appear in journal fields on forms. It can have an adverse impact on functionality, and on user interactions with the resulting data. If this property negatively affects functionality, set glide.ui.security.codetag.allow_script to false to disable script execution within `[code]` tags while preserving HTML rendering. |
| Security risk | (Medium) Input validation must occur in the application to defend against cross-site scripting attacks. These attacks enable foreign scripts to execute on a user session in the logged in browser's context. Attackers can use it to steal session information and sensitive data. |
[ ]
{#sc-allow-embedded-html-code__table_ajc_b43_3kb}