Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable
Use the glide.xmlutil.max_entity_expansion property to change the maximum entity expansion limit to a smaller number.
The glide.xmlutil.max_entity_expansion system property controls the maximum amount of entity expansion within an XML Parser. If glide.xmlutil.max_entity_expansion isn't set to the recommended value of 3000 or less, then the GlideXMLUtil parsing scriptable may be vulnerable to denial of service attacks.
Ensure that the property glide.xmlutil.max_entity_expansion is set to 3000 or less.
If the instance is on Washington or later, the default implied value is 3000 if the System Properties [sys_properties] record does not exist. If the instance is not on Washington or later, the recommendation is for the instance admin to create a System Properties [sys_properties] and set the value to 3000.
Note: 500 is the default minimum imposed by the ServiceNow AI Platform, which is considered to be a safe threshold.
More information
| Attribute | Description |
|---|---|
| Configuration name | **** |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Integer |
| Recommended value | Less than or equal to 3000 |
| Default value | <none> |
| Fallback value | 3000 |
| Category | Validation, sanitization, and encoding |
| Security risk | - Severity score: 5.3 - CVSS rating: Medium - Security risk details: A Denial-of-Service \(DoS\) vulnerability poses a security risk by allowing attackers to overwhelm or crash a system, rendering it unavailable to legitimate users and potentially disrupting critical operations. |
| Functional impact | If the customization is using large entity expansion, then, the ServiceNow AI Platform might block further processing. |
| Dependencies and prerequisites | None |
To learn more about adding or creating a system property, see Add a system property.
Parent Topic:Validation, sanitization, and encoding