---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable Jelly JS Interpolation Protection

# Enable Jelly JS Interpolation Protection {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.ui.jelly.js_interpolation.protect property to ensure
that any JavaScript about to be executed on a Jelly page is protected from injection with the
help of Jelly interpolation.
When you set property to true, an application goes through a Jelly script tree (nested). It wraps potentially dangerous Jelly expressions with a filter that:

* Escapes their results to be safe, or
* If their safety can't be guaranteed, generates a SecurityException because the expression that was going to be evaluated represents a possible security issue.

{#sc-enable-jelly-js-interpolation-protection__ul_wx4_2hr_nkb}  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-enable-jelly-js-interpolation-protection__section_more_information}

{#sc-enable-jelly-js-interpolation-protection__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.ui.jelly.js_interpolation.protect |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Purpose | To mitigate against malicious code execution attacks that can occur using Jelly Injection. |
| Recommended value | true |
| Default value | true |
| Security risk rating | 9 |
| Functional impact | This property makes a best guess at whether an expression is quoted. It may wrongly quote legitimate expression. In that case manually marking an expression as safe may be necessary. |
| Security risk | (Moderate) JEXL injection is a form of input injection unique to the ServiceNow AI Platform that can lead to both cross-site request forgery and code execution. Completely turning off the protection may potentially open many P1 security vulnerabilities. |
| Workaround | To manually mark an expression as safe add SAFE prefix to Jelly expression: `${SAFE:sysparm_input};` Blindly adding SAFE to each expression is the wrong way to approach the problem, because it may open a security vulnerability. * Only add SAFE to an expression if you can guarantee that the expression does not contain input from the client. * If it does, it's possible for a malicious client to cause evaluation of privileged JavaScript. {#sc-enable-jelly-js-interpolation-protection__ul_yzl_wnx_nkb} |
| References | [Jelly tags](https://www.servicenow.com/docs/access?context=r_JellyTags&version=australia&pubname=australia-api-reference&ft:locale=en-US) [High Security Settings](https://servicenow-prod.fluidtopics.net/f8gVxeeTKuTUbGIE_Ua8hw "High Security Settings refer to several security options available in your instance.") |
[ ]

{#sc-enable-jelly-js-interpolation-protection__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).