---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict XML external entities \[Updated in Security Center 1.3 and 2.0\]

# Restrict XML external entities \[Updated in Security Center 1.3 and 2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Configure system properties to ensure that your instance only processes XML from trusted sources to help prevent XML external entity (XXE) attacks.
Use the glide.xml.entity.whitelist and glide.xml.entity.whitelist system properties to prevent your instance from processing XML from untrusted sources.

XML external entity (XXE) attacks occur when a malicious actor modifies incoming XML (such as adding HTTP requests) to access data or intact with otherwise restricted systems. To help prevent these attacks, the
glide.xml.entity.whitelist.enabled system property limits the sources from which your instance executes XML. Use the glide.xml.entity.whitelist property to define a set of trusted
sources.

Ensure that the glide.xml.entity.whitelist system property exists in the System Properties \[sys_properties\] table, and is set to <kbd class="ph userinput">http://java.sun.com/j2ee/dtds/</kbd>. Ensure that the
glide.xml.entity.whitelist.enabled system property exists in the System Properties \[sys_properties\] table and is set to the value <kbd class="ph userinput">true</kbd>.  
Tipp:  
Values other than <kbd class="ph userinput">http://java.sun.com/j2ee/dtds/</kbd> can be included in the glide.xml.entity.whitelist property, but are unnecessary for the out of the box platform state. Review any
additional values to determine if they are safe.  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-xml-entity-validation-url-allowlist__section_wc1_cqn_phc}

{#sc-xml-entity-validation-url-allowlist__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | * glide.xml.entity.whitelist * glide.xml.entity.whitelist.enabled {#sc-xml-entity-validation-url-allowlist__ul_nfc_ls1_b3c} |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | * String * Boolean {#sc-xml-entity-validation-url-allowlist__ul_r2v_ms1_b3c}String |
| Recommended value | * http://java.sun.com/j2ee/dtds/ * true {#sc-xml-entity-validation-url-allowlist__ul_xln_ms1_b3c} |
| Default value | * http://java.sun.com/j2ee/dtds/ * true {#sc-xml-entity-validation-url-allowlist__ul_jns_ns1_b3c} |
| Fallback value | * http://java.sun.com/j2ee/dtds/ * true {#sc-xml-entity-validation-url-allowlist__ul_cm4_4s1_b3c} |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 9.8 * CVSS score: Critical * Security risk details: An XML Eternal Entity (XEE) attack can allow attackers to access data or perform unauthorized actions via crafted XML payloads. {#sc-xml-entity-validation-url-allowlist__ul_g1g_3sf_xwb} |
| Functional impact | If the customization is using external entity, not inclusion listed in the glide.xml.entity.whitelist property, the NOW Platform might block further processing. |
| Dependencies and prerequisites | None |
[ ]

{#sc-xml-entity-validation-url-allowlist__table_ajc_b43_3kb}