Setting entity expansion threshold

Setting entity expansion threshold (instance security hardening)

Platform Security > <a class="link" href="../../../administer/security/concept/instance-security-center.html" title="Monitor the compliance level of instance security controls, view security event monitoring metrics, and configure and maintain instance security settings all from within the Instance Security Center. The Instance Security Center consolidates several key security components into a single control console that helps you detect, protect, and respond to instance-based security events.">Instance Security Center > <a class="link" href="../../../administer/security/reference/instance-security-hardening-settings.html" title="The Instance Security Hardening Settings content contains detailed descriptions and compliance values for the security-related system properties and plugins in the Now Platform. You can set most of these properties in the Hardening Compliance Configuration page in the Instance Security Center.">Instance Security Hardening Settings > Security inclusion list (instance security hardening) > <a class="link" href="../../../administer/security/reference/xml-external-entity-processing-validation.html" title="These properties enable entity expansion, and restrict any external entity (for example, URL) when included as a part of XML DOCTYPE reference. DTD is basically an XML schema. If you are looking for a solution for entity declarations that could have potential for XXE (external entity), enable an inclusion listed defense against XXE using system properties.">XML external entity processing validation >

Setting entity expansion threshold (instance security hardening)

Use the glide.xmlutil.max_entity_expansion property to change the maximum entity expansion limit to a smaller number.

The Now Platform doesn't process further entity expansions that are greater than the allowed limit specified in this property. Note: 3000 is the default minimum imposed by the Now Platform , which is considered to be a safe threshold. Hence, platform considers this default minimum if the integer value you enter is below 3000.

More information Attribute Description Property name glide.xmlutil.max_entity_expansion Configuration type System Properties (/sys_properties_list.do) Configure in Instance Security Center Yes Purpose This remediation control must be enabled to defend against XML Entity Expansion/Billion Laugh attack. Recommended value 3000 Functional Impact If the customization is using large entity expansion, then, the Now Platform might block further processing. Security risk (High) An attacker can use this vulnerability to expand data exponentially, quickly consuming all system resources.

To learn more about adding or creating a system property, see Add a system property .

Parent Topic: For XMLDocument and XMLUtil parsing