How to test ensuring contextual search does not contain an unvalidated redirect.<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } There is a new option for instance security hardening on how to ensure contextual search does not contain an unvalidated redirect. [New in Security Center 7.0] You can find the relevant documentation below: https://www.servicenow.com/docs/r/platform-security/instance-security-hardening-settings/sc-ensure-contextual-search-do-not-contain-an-unvalidated-redirect.html To test this you can create a new sc_cat_item_content record. Set this to content type "External Content" and Target "New Window/Tab" Associate it to a catalog, for my example I am using "Service Catalog" and Category "Services". Add any external URL, for this example I used "https://google.com" Submit the record. Once submitted you can go to any incident record and use the "Related Search" to search for your new content item. While the system property "com.snc.contextual_search.cxs_new_window.force_relative_link" is set to false you will be able to open and click the link, redirecting you to the external URL. While the system property is set to true you will see the following message instead: