Impacts of KB1982254 Glide Property DeprecationIssue We need to know the impact of applying security properties and how to know which scripts or integrations will be affected by changing the properties as indicated on this KB:https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1982254#mcetoc_1im92em0d9iReleasenot specific to any releasesResolutionEach property typically enforces a tighter security control. For example: glide.stax.allow_entity_resolution: Controls external entity expansion in XML parsing to prevent XXE attacks. glide.sys_reference_row_check: Ensures users have read access to referenced records before they can see the reference field's display value. glide.soap.strict_types: Enforces strict type checking on inbound SOAP requests. glide.ui.escape_double_curly: Escapes {{}} templates in UI Pages/Widgets to avoid XSS risks. Common Impacts by Property 1. glide.stax.allow_entity_resolution Purpose: Prevents XML External Entity (XXE) attacks by disallowing XML entity expansion when parsing XML data. Impact: Integrations or scripts relying on external DTDs or XML entities may fail. For example, if an incoming XML includes declarations, they will be blocked. What to Test: Test SOAP integrations or XML import sets that handle complex XML structures. Look for parsing errors or data not being extracted correctly. 2. glide.sys_reference_row_check Purpose: Enforces ACL checks on the referenced records of reference fields (e.g., "Assignment group" in Incident). Impact: Users may see blank fields or encounter errors if they have access to a form (like Incident) but not to the referenced record (like a specific sys_user_group). What to Test: Login with restricted user roles and navigate to records with reference fields. Check if reference fields still display values as expected. 3. glide.soap.strict_types Purpose: Enforces strict data type validation for incoming SOAP messages. Impact: SOAP integrations that do not conform to the expected data types (e.g., sending a string for a number) will fail. What to Test: Review and test all SOAP clients. Monitor the ECC Queue and syslog for errors related to type mismatches. 4. glide.ui.escape_double_curly Purpose: Escapes double curly braces ({{ }}) in widgets and UI macros to prevent unescaped server-side script injection. Impact: Custom widgets or UI Pages using {{ some value }} might render raw text or break functionality. What to Test: Inspect any custom widgets, macros, and pages for use of {{ }} and replace them with secure alternatives. 5. glide.login.internal.controls.enabled Purpose: Enables login throttling and locking based on failed login attempts and other security controls. Impact: Can inadvertently lock out valid users, especially admins, during misconfiguration or brute-force scenarios. What to Test: Simulate multiple failed login attempts. Ensure appropriate alerts are configured and fallback admin access is available. 6. glide.security.allow_eval Purpose: Disables the use of the eval() function in scripts, which is often exploited in attacks. Impact: Any script using eval() will fail. This includes Business Rules, Script Includes, and Widgets. What to Test: Search the system for eval( and refactor the logic to avoid it. Validate scripts post-change. 7. glide.scriptrunner.enable_secure_mode Purpose: Enforces secure mode for Script Includes, restricting access to certain APIs or global objects. Impact: Legacy or custom scripts that assume access to global objects or classes may stop working. What to Test: Validate all Script Includes and server-side scripts. Test workflows and automation that rely on them. 8. glide.security.csrf.enabled Purpose: Enables Cross-Site Request Forgery protection across the platform. Impact: Custom pages, widgets, or integrations sending POST requests without CSRF tokens will fail. What to Test: Review custom widgets and 3rd-party form submissions. Ensure proper CSRF tokens are present in headers. 9. glide.security.ui.xss_protection.enabled Purpose: Provides stronger protection against Cross-Site Scripting (XSS) attacks in UI rendering. Impact: HTML fields may now escape code, causing certain descriptions or knowledge articles to render incorrectly. What to Test: Review forms, knowledge articles, and any HTML-enabled fields for content rendering issues.