Validation, sanitization, and encoding

Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.

This control ensures input validation and output encoding are in place and correctly configured, such as encoding or escaping output data. This category also includes checks for items such as deserialization of objects and positive validation through allow lists.

• Allow HTML Links to Trusted Domains in the Description Fields of the Impact Workspace Module [New in Security Center 7.0]
  Use a system property to help sanitize the HTML allowed in the descriptions fields. This property limits the allowed links to only those from the trusted domains listed in the property.

• Enable the hardened java security manager
  The glide.security.manager property contains the Java classname of the current Java security manager.

• Enable HTML Sanitizer [Updated in Security Center 1.3]
  Use the glide.html.sanitize_all_fields property to enable the HTMLSanitizer script include, which sanitizes HTML input based on exclusion listed and inclusion listed attributes configured in a script.

• Enable script sandbox [Updated in Security Center 1.3]
  Use the glide.script.use.sandbox property to enable script sandboxing.

• Enforce HTML Sanitization
  Use the com.glide.security.check_unsanitized_html property to enforce sanitization behavior of translated_html fields on a global level for field assignments.

• Ensure Contextual Search Do Not Contain An Unvalidated Redirect [New in Security Center 7.0]
  Prevent Contextual Search results from containing referral links outside the current domain with a system property.

• Disable AJAXEvaluate
  Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls.

• Disable Entity Expansion within the XMLDocument2 Streaming Parser
  If customizations do not require entity expansion, use the glide.stax.allow_entity_resolution property to completely disable external entity expansion. The XML completes parsing but doesn’t include any internal or external entities.

• Disable external content URL
  Manage how external link metadata is used in your instance with Connect Chat.

• Disable JavaScript tags in embedded HTML
  Use the glide.ui.security.codetag.allow_script property to disable support for embedding HTML JavaScript code created using of the [code] tag.

• Disable embedded HTML code [Updated in Security Center 1.3]
  Use the glide.ui.security.allow_codetag property to disable support for embedding HTML code created using the [code] tag.

• Restrict downloadable MIME types
  The glide.ui.attachment.download_mime_types property will force the specified list of dangerous file types to be downloaded to the client and not viewed inline in the browser.

• Enable HTML Sanitizer within Virtual Agent
  Use the com.glide.cs.html.sanitizer.enabled property to enable HTMLSanitizerService.

• Enable Jelly JS Interpolation Protection
  Use the glide.ui.jelly.js_interpolation.protect property to ensure that any JavaScript about to be executed on a Jelly page is protected from injection with the help of Jelly interpolation.

• Enable Jelly JS interpolation protection for nested expressions
  Manage the interpolation protection on your instance.

• Enforce relative links
  Use the glide.cms.catalog_uri_relative property to enforce relative links from the URI parameter on /ess/catalog.do.

• Enforce URL allowlist check
  Use the glide.security.url.whitelist system property to add extra layer of validation to ensure whether any external URL introduced should be a part of inclusion listed URLs.

• Escape Excel formulas [Updated in Security Center 1.3]
  Use the glide.export.escape_formulas property to prevent Excel Injection, also, known as formula injection.

• Escape HTML in list views [Updated in Security Center 1.3 and 1.5]
  Use the glide.ui.escape_html_list_field property to force HTML escapes for HTML fields in a list view.

• Escape JavaScript [Updated in Security Center 1.3]
  Use the glide.html.escape_script property to force escape from JavaScript (<script></script>) tags in HTML fields during list views.

• Escape jelly script [Updated in Security Center 1.3 and 1.5]
  Use the glide.ui.escape_all_script property to force escape of all scripts injected into Jelly.

• Escape scripts in scratchpad
  Learn how scratchpad factors into the security posture of your instance and how to manage it so that malicious scripts can’t be executed on it.

• Escape XML markup
  Use the glide.ui.escape_text property to force escape of XML values at the parser level before transmitting them to the client’s browser.

• Escape xml response
  Manage how XML escapes are handled on your instance.

• Restrict access to GlideSystemUserSession scriptable API
  The client callable GlideSystemUserSessionSandbox scriptable API exposes GlideSystemUserSession’s addErrorMessageNoSanitization and addInfoMessageNoSanitization methods to the JavaScript sandbox. This allows all users to call this method via script.

• Restrict allowed Java packages [Updated in Security Center 1.3]
  Configuring these properties protect from dangerous APIs being exposed to the scripting engine.

• Unset LDAP Initial distinguished name [Updated in Security Center 1.3 and removed in 2.0]
  Use this property to manage the distinguished name of a LDAP Server record.

• Enforce strict security of session cookies
  Use the glide.ui.secure_cookies property to require properly formatted cookies

• Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable
  Use the glide.xmlutil.max_entity_expansion property to change the maximum entity expansion limit to a smaller number.

• Prevent Empty ACL Creation
  Set the glide.security.empty_acl.popup_window.enabled property to the secure value of true to block attempts to create, update, or save an invalid ACL. This setting will also provide a client-side model to configure a role or security attribute for the ACL.

• Prevent Reuse of REST API Sessions in UI/Web
  Prevent REST API session cookies from bypassing Single Sign-On (SSO) and Multi-Factor Authentication (MFA) controls using a system property.

• Define restricted downloadable MIME types [Updated in Security Center 1.3, 1.5, and 2.0]
  Use the glide.ui.attachment.force_download_all_mime_types property to download MIME types and not to render inline in the browser.

• Restrict uploaded MIME types
  Use the glide.security.file.mime_type.validation property to activate MIME type checking for uploads. You can enable (set the property to true) or disable (set it to false) MIME type validation for file attachments.

• Restrict XML external entities
  Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks.

• Require XMLdoc2 entity validation with allowlist
  If customizations do not require entity expansion, use the glide.xmlutil.max_entity_expansion property to completely disable external entity expansion. The XML completes parsing but doesn’t include any internal or external entities.

• Sanitize All Translated HTML Fields
  Learn how to configure the glide.translated_html.sanitize_all_fields property to the secure value to ensure that all translated_html elements are sanitized with an HTML sanitizer.

• Sanitize HTML in the Description Fields of the Impact Workspace Module [New in Security Center 7.0]
  Sanitize the HTML in the description fields by removing HTML tags that are sources of HTML injection attacks with the sn_impact_common.blacklist_tags_HTML_injection property.

• Set safe content security policy for SVG files
  The com.glide.csp.self_script_src_svg property adds the script-src none directive to the HTTP Content-Security-Policy header when Scalable Vector Graphics (SVGs) are accessed through the Translation Memory Index (IIX) file extension.

• Validate MIME Type for Multi-Extension Filenames, Polyglot Files, and Null-Byte Injection
  Use a system property to prevent attachments from bypassing MIME-type restrictions.

Parent Topic:Hardening settings