Escape XML markup
Use the glide.ui.escape_text property to force escape of XML values at the parser level before transmitting them to the client's browser.
Use the glide.ui.escape_text system property to escape XML values at the parser level for the user interface. It prevents reflected and stored cross-site scripting attacks. This property is not applicable in Service Portal.
Cross-site scripting occurs when an attacker injects malicious JavaScript into an entry point. The platform/application fails to escape the malicious JavaScript before transmitting it to the victim's browser for execution. Escaping in this context means the following:
- & -->
& - < -->
< - > -->
> - " -->
" - ' -->
' - / -->
/
Example: <script>alert('XSS Attack');</script>
Escaping: <script>alert('XSS Attack');</script>
Ensure the glide.ui.escape_text property exists in the System Properties [sys_properties] table and is set to true.
Warning: This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.ui.escape_text |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | <none> |
| Fallback value | false |
| Category | Validation, sanitization, and encoding |
| Security risk |
If glide.ui.escape_text is not set to the recommended value of true, then XML values will not be escaped at the parser level for the user interface; this will leave jelly templates susceptible to reflected and stored cross site scripting attacks. |
| Functional impact | None |
| Dependencies and prerequisites | None |
Parent Topic:Validation, sanitization, and encoding