GlideSecurityUtils - Scoped, Global

The GlideSecurityUtils API provides methods to work with URLs.

Access these methods using the static object GlideSecurityUtils. This class is available in scoped and global scripts.

Parent Topic:Server API reference

GlideSecurityUtils - cleanURL(String url)

Removes suspicious encoding to prevent reflected or DOM based cross site scripting.

myurl='javascript%3Aalert(1)';
var clean=GlideSecurityUtils.cleanURL(myurl);
gs.info(clean);

Output: null

GlideSecurityUtils - enforceRelativeURL(String url)

Removes the domain address from the URL, which leaves the page name and parameters.

myurl='http://evildomain.com/test.do';
relativeURL=GlideSecurityUtils.enforceRelativeURL(myurl);
gs.info(relativeURL);

Output: test.do

GlideSecurityUtils - escapeScript(String script)

Add escape characters to a script.

Adding escape characters to a script helps prevent cross-site scripting.

theScript="<script> alert(1)</script>";
var escapedScript=GlideSecurityUtils.escapeScript(theScript);
gs.info(escapedScript);

Output: <script> alert(1)</script>

GlideSecurityUtils - isURLWhiteListed(String url)

Check the specified URL against the system defined allow list.

myURL="http://evil.com/badscript.do";
isWhitelisted=GlideSecurityUtils.isURLWhiteListed(myURL);
gs.info(isWhitelisted);

Output: false