---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Disable Entity Expansion within the XMLDocument2 Streaming Parser \[Updated in Security Center 1.5\]

# Disable Entity Expansion within the XMLDocument2 Streaming Parser \[Updated in Security Center 1.5\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

If customizations do not require entity expansion, use the glide.stax.allow_entity_resolution property to completely disable external entity expansion. The XML completes parsing but doesn't include any
internal or external entities.
Disable entity expansion on your instance to secure your instance from attacks such as ability to read system files, and Denial of Service. Use the system property to disallow XML entities to be expanded during parsing by the
streaming parser (XMLDocument2).

Set the glide.stax.allow_entity_resolution system property to false to disable entity expansion on your instance. If this property does not appear in the System Properties
\[sys_properties\] table, the default value is true. Create the property record and set the value to false to change it's value.

## Prerequisites {#sc-disable-entity-expansion__section_msm_4zy_jlb}

Before setting this property:

* Set the glide.xml.entity.whitelist.enabled and glide.stax.whitelist_enabled properties to true. To learn more, see [Restrict XML external entities \[Updated in Security Center 1.3 and 2.0\]](llsO9Yysck5_qCq9Xj63iw "Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks.") and [Require XMLdoc2 entity validation with allowlistDisable entity expansion \[Updated in Security Center 1.3\]](v~nwcMN12szyMGkouHYwaA "If customizations do not require entity expansion, use the glide.xmlutil.max_entity_expansion property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities.").
* Define a listing of comma-delimited FQDN in the glide.xml.entity.whitelist property, which is the only URLs that can be reached using XML Entity processing. property. To learn more, see [Restrict XML external entities \[Updated in Security Center 1.3 and 2.0\]](llsO9Yysck5_qCq9Xj63iw "Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks.").
{#sc-disable-entity-expansion__ul_dfz_hgk_llb}  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-disable-entity-expansion__section_more_information}

{#sc-disable-entity-expansion__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.stax.allow_entity_resolution |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Purpose | This remediation control must be enabled to defend against an XML Entity Expansion/Billion Laugh attack. |
| Recommended value | false |
| Default value | false |
| Functional impact | If the customization is using entity expansion, then, the ServiceNow AI Platform might block further processing. |
| Security risk | (Critical) An attacker can use this vulnerability to expand data exponentially, quickly consuming all system resources. |
| Workaround | If the customization requires entity expansion, set this property to true and follow the steps documented in [Require XMLdoc2 entity validation with allowlistDisable entity expansion \[Updated in Security Center 1.3\]](v~nwcMN12szyMGkouHYwaA "If customizations do not require entity expansion, use the glide.xmlutil.max_entity_expansion property to completely disable external entity expansion. The XML completes parsing but doesn't include any internal or external entities."). |
[ ]

{#sc-disable-entity-expansion__table_ajc_b43_3kb}

To learn more about adding or creating a system property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US)

For more information about OWASp resources, see [OWASp](https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)).