---
sourceDocument: Xanadu API Reference
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/xanadu/api-reference

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# GlideSecurityUtils - Scoped, Global

# GlideSecurityUtils - Scoped, Global {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The GlideSecurityUtils API provides methods to work with URLs.

Access these methods using the static object GlideSecurityUtils. This class is available in scoped and global scripts.

## GlideSecurityUtils - cleanURL(String url) {#ariaid-title2}

Removes suspicious encoding to prevent reflected or DOM based cross site
scripting.
{#GSU-cleanURL_S__table_htv_mgh_5cb__entry__3}

| Name | Type | Description |
|-|-|-|
| url | String | The URL to be checked. |
[Table 1. Parameters]

{#GSU-cleanURL_S__table_htv_mgh_5cb} {#GSU-cleanURL_S__table_itv_mgh_5cb__entry__2}

| Type | Description |
|-|-|
| String | The URL stripped of problem elements. |
[Table 2. Returns]

{#GSU-cleanURL_S__table_itv_mgh_5cb}  

    myurl='javascript%3Aalert(1)';
    var clean=GlideSecurityUtils.cleanURL(myurl);
    gs.info(clean);

Output: null

## GlideSecurityUtils - enforceRelativeURL(String url) {#ariaid-title3}

Removes the domain address from the URL, which leaves the page name and
parameters.
{#GSU-enforceRelativeURL_S__table_ktx_mjh_5cb__entry__3}

| Name | Type | Description |
|-|-|-|
| url | String | The URL to be turned into a relative URL. |
[Table 3. Parameters]

{#GSU-enforceRelativeURL_S__table_ktx_mjh_5cb} {#GSU-enforceRelativeURL_S__table_ltx_mjh_5cb__entry__2}

| Type | Description |
|-|-|
| String | A relative URL. |
[Table 4. Returns]

{#GSU-enforceRelativeURL_S__table_ltx_mjh_5cb}  

    myurl='http://evildomain.com/test.do';
    relativeURL=GlideSecurityUtils.enforceRelativeURL(myurl);
    gs.info(relativeURL);

Output: test.do

## GlideSecurityUtils - escapeScript(String script) {#ariaid-title4}

Add escape characters to a script.
Adding escape characters to a script helps prevent cross-site scripting.
{#GSU-escapeScript_S__table_hrz_13h_5cb__entry__3}

| Name | Type | Description |
|-|-|-|
| script | String | The script to have escape characters added. |
[Table 5. Parameters]

{#GSU-escapeScript_S__table_hrz_13h_5cb} {#GSU-escapeScript_S__table_irz_13h_5cb__entry__2}

| Type | Description |
|-|-|
| String | The script with escape characters added. |
[Table 6. Returns]

{#GSU-escapeScript_S__table_irz_13h_5cb}  

    theScript="<script> alert(1)</script>";
    var escapedScript=GlideSecurityUtils.escapeScript(theScript);
    gs.info(escapedScript);

Output: `&lt;script&gt; alert(1)&lt;/script&gt;`

## GlideSecurityUtils - isURLWhiteListed(String url) {#ariaid-title5}

Check the specified URL against the system defined allow list.
{#GSU-isURLWhiteListed_S__table_j4v_dlh_5cb__entry__3}

| Name | Type | Description |
|-|-|-|
| url | String | The URL to be checked against the URL allow list. |
[Table 7. Parameters]

{#GSU-isURLWhiteListed_S__table_j4v_dlh_5cb} {#GSU-isURLWhiteListed_S__table_k4v_dlh_5cb__entry__2}

| Type | Description |
|-|-|
| Boolean | Returns true if the specified URL is in the allow list. |
[Table 8. Returns]

{#GSU-isURLWhiteListed_S__table_k4v_dlh_5cb}  

    myURL="http://evil.com/badscript.do";
    isWhitelisted=GlideSecurityUtils.isURLWhiteListed(myURL);
    gs.info(isWhitelisted);

Output: false