---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Allow HTML Links to Trusted Domains in the Description Fields of the Impact Workspace Module \[New in Security Center 7.0\]

# Allow HTML Links to Trusted Domains in the Description Fields of the Impact Workspace Module \[New in Security Center 7.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use a system property to help sanitize the HTML allowed in the descriptions fields. This property limits the allowed links to only those from the trusted domains listed in the property.
Hinweis:  
This hardening setting is not a part of the hardening baseline. It does not appear in Security Center hardening pages and affect your hardening score.

The Impact Workspace module allows HTML in a number of description-related fields. When configured, the sn_impact_common.whitelisted.url_HTML_injection system property contains a comma-separated list of domain
names. Description fields for the Impact Workspace module are allowed to contain HREFs with URLs only from the domains listed in the property.

Ensure the sn_impact_common.whitelisted.url_HTML_injection system property is set to a comma-separated list of domain names that represent the domains allowed in HTTP reference URLs of description fields for
the Impact Workspace module.

To disallow HREFs in these fields, set the property to an empty string. If the property doesn't exist on the System Properties \[sys_properties\] table, it defaults to this list: <kbd class="ph userinput">servicenow.com, service-now.com, youtube.com, google.com, youtu.be, soti.net, dpdhl.sharepoint.com, documentation.avaya.com, www.juniper.net, servicenow.sharepoint.com, servicenow-my.sharepoint.com, scaledagileframework.com</kbd>.

## More information {#sc-allow-html-links-to-trusted-domains-in-the-description-fields-of-the-impact-workspace-module__section_lnh_pkf_32c}

{#sc-allow-html-links-to-trusted-domains-in-the-description-fields-of-the-impact-workspace-module__table_hhv_dvg_1xb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | sn_impact_common.whitelisted.url_HTML_injection |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String list |
| Recommended value | servicenow.com, service-now.com, youtube.com, google.com, youtu.be, soti.net, dpdhl.sharepoint.com, documentation.avaya.com, www.juniper.net, servicenow.sharepoint.com, servicenow-my.sharepoint.com, scaledagileframework.com |
| Default value | servicenow.com, service-now.com, youtube.com, google.com, youtu.be, soti.net, dpdhl.sharepoint.com, documentation.avaya.com, www.juniper.net, servicenow.sharepoint.com, servicenow-my.sharepoint.com, scaledagileframework.com |
| Fallback value | servicenow.com, service-now.com, youtube.com, google.com, youtu.be, soti.net, dpdhl.sharepoint.com, documentation.avaya.com, www.juniper.net, servicenow.sharepoint.com, servicenow-my.sharepoint.com, scaledagileframework.com |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 4.4 * CVSS score: Medium * If an untrusted domain is added to the property, this opens these fields up to containing links to risky sources which can lead HTML injection attacks. The exact risk is dependent on the customer instance. {#sc-allow-html-links-to-trusted-domains-in-the-description-fields-of-the-impact-workspace-module__ul_ihv_dvg_1xb} |
| Functional impact | If the property is empty, no HREFs are allowed in the field text and all HREFs are removed. Any links using domains not listed in the property are removed. An improper value for this field could result in corrupted data for the affected fields. |
| Dependencies and prerequisites | If the sn_impact_common.blacklist_tags_HTML_injection system property contains HTML tags that surround HREF links, then all links within those tags will be removed. |
[ ]

{#sc-allow-html-links-to-trusted-domains-in-the-description-fields-of-the-impact-workspace-module__table_hhv_dvg_1xb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).