The GlideSecurityUtils API provides methods to work with URLs.

Access these methods using the static object GlideSecurityUtils. This class is available in scoped and global scripts.

GlideSecurityUtils - cleanURL(String url)

Removes suspicious encoding to prevent reflected or DOM based cross site scripting.

Table 1. Parameters
Name Type Description
url String The URL to be checked.
Table 2. Returns
Type Description
String The URL stripped of problem elements.

Example

myurl='javascript%3Aalert(1)';
var clean=GlideSecurityUtils.cleanURL(myurl);
gs.info(clean);

Output: null

GlideSecurityUtils - enforceRelativeURL(String url)

Removes the domain address from the URL, which leaves the page name and parameters.

Table 3. Parameters
Name Type Description
url String The URL to be turned into a relative URL.
Table 4. Returns
Type Description
String A relative URL.

Example

myurl='http://evildomain.com/test.do';
relativeURL=GlideSecurityUtils.enforceRelativeURL(myurl);
gs.info(relativeURL);

Output: test.do

GlideSecurityUtils - escapeScript(String script)

Add escape characters to a script.

Adding escape characters to a script helps prevent cross-site scripting.

Table 5. Parameters
Name Type Description
script String The script to have escape characters added.
Table 6. Returns
Type Description
String The script with escape characters added.

Example

theScript="<script> alert(1)</script>";
var escapedScript=GlideSecurityUtils.escapeScript(theScript);
gs.info(escapedScript);

Output: &lt;script&gt; alert(1)&lt;/script&gt;

GlideSecurityUtils - isURLWhiteListed(String url)

Check the specified URL against the system defined allow list.

Table 7. Parameters
Name Type Description
url String The URL to be checked against the URL allow list.
Table 8. Returns
Type Description
Boolean Returns true if the specified URL is in the allow list.

Example

myURL="http://evil.com/badscript.do";
isWhitelisted=GlideSecurityUtils.isURLWhiteListed(myURL);
gs.info(isWhitelisted);

Output: false