---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Define restricted downloadable MIME types \[Updated in Security Center 1.3, 1.5, and 2.0\]

# Define restricted downloadable MIME types \[Updated in Security Center 1.3, 1.5, and
2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.ui.attachment.force_download_all_mime_types property to download MIME types and not to render inline in the browser.
If glide.ui.attachment.download_mime_types does include dangerous MIME types such as text/html, image/svg ,image/svg+xml,application/xml, then dangerous files could be rendered inline in the browser, which
could lead to Cross Site Scripting attacks (XSS). This property is the list of comma-separated attachment mime types, which won't render inline in the browser. For example, including text/html forces HTML files to be downloaded
to the client as attachments rather than viewed inline in the browser. Maintaining this list properly prevents cross-site scripting attacks.

If the glide.ui.attachment.download_mime_types system property doesn't include dangerous MIME types such as "text/html, image/svg,image/svg+xml,application/xml", then dangerous files could be rendered inline
in the browser. This can lead to Cross Site Scripting (XSS) attacks. This check is only relevant when glide.ui.attachment.force_download_all_mime_types is set to false.

This property is a list of comma-separated attachment MIME types, which don't render inline in the browser. For example, including <kbd class="ph userinput">text/html</kbd> forces HTML files to be downloaded to the client as attachments
rather than viewed inline in the browser.

If glide.ui.attachment.force_download_all_mime_types is set to false, verify that the glide.ui.attachment.download_mime_types system property includes the
dangerous MIME types <kbd class="ph userinput">text/html,image/svg,image/svg+xml,application/xml</kbd>.

## More information {#sc-downloadable-mime-types__section_qhx_1b1_xwb}

{#sc-downloadable-mime-types__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.attachment.force_download_all_mime_types |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String (Comma-separated list of MIME types) |
| Recommended value | text/html,image/svg,image/svg+xml,application/xml |
| Default value | text/html,image/svg,image/svg+xml,application/xml |
| Fallback value | text/html,image/svg,image/svg+xml,application/xml |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 6.3 * CVSS score: Medium * Security Risk: Maintaining this list properly can prevent cross site scripting attacks. {#sc-downloadable-mime-types__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | This check is only relevant when glide.ui.attachment.download_mime_types is set to false or doesn't exist in the System Properties \[sys_properties\] table. |
[ ]

{#sc-downloadable-mime-types__table_ajc_b43_3kb}