---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Sanitize HTML in the Description Fields of the Impact Workspace Module \[New in Security Center 7.0\]

# Sanitize HTML in the Description Fields of the Impact Workspace Module \[New in Security Center 7.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Sanitize the HTML in the description fields by removing HTML tags that are sources of HTML injection attacks with the sn_impact_common.blacklist_tags_HTML_injection property.
The Impact Workspace module allows HTML in the following description fields:

* The customer_notes field of the sn_impact_common_capabilities_map and sn_impact_common_par_version_phase_app_mapping tables.
* The manual_description field of the sn_impact_common_manual_capability_description table.
{#sanitize-html-in-the-description-fields-of-the-impact-workspace-module__ul_acv_phn_pfc}

When this system property contains a comma-separated list of HTML tags (for example, scripts), those tags and their contents are removed from the HTML portions of the listed fields. Removing these tags helps sanitize the HTML in
the description fields by removing HTML tags that are sources of HTML injection attacks. If this property isn't set in the System Properties \[sys_properties\] table, the value defaults to a default list of denied HTML tags. If the
property is empty, all HTML tags are allowed.

Use the sn_impact_common.blacklist_tags_HTML_injection provide a comma-separated list of HTML tags which are removed from the description fields for the Impact Workspace module. This removal helps to prevent
HTML injection attacks. At minimum, this list should contain the contents of the default list. If the property isn't set in the System Properties \[sys_properties\] table, it defaults to the list
`script,iframe,object,embed,form,onerror,onload,style,img,video,audio,source,button`.

## More information {#sanitize-html-in-the-description-fields-of-the-impact-workspace-module__section_more_information}

{#sanitize-html-in-the-description-fields-of-the-impact-workspace-module__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | sn_impact_common.blacklist_tags_HTML_injection |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Purpose | Sanitize the HTML in the description fields by removing HTML tags that are sources of HTML injection attacks. |
| Recommended value | At minimum, the default value of `script,iframe,object,embed,form,onerror,onload,style,img,video,audio,source,button` |
| Default value | `script,iframe,object,embed,form,onerror,onload,style,img,video,audio,source,button` |
| Security risk rating | 4.4 |
| Functional impact | If an HTML tag is added to default list, it may limit the required HTML functionality of the description fields. The exact impact is dependent on the customer instance. |
| Security risk | (Medium) |
| References | [High Security Settings](https://servicenow-prod.fluidtopics.net/f8gVxeeTKuTUbGIE_Ua8hw "High Security Settings refer to several security options available in your instance.") |
[ ]

{#sanitize-html-in-the-description-fields-of-the-impact-workspace-module__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).