ServiceNow attachment properties: block file types, limit size, control downloads

Block .exe and other file types

There are two ways to restrict file types. An allow list (glide.attachment.extensions) names the extensions users may upload and rejects everything else. An exclusion list (glide.attachment.blacklisted.extensions and glide.attachment.blacklisted.types, active while glide.security.attachment_type.use_blacklist is true) names what is blocked and lets the rest through.

An allow list is the stronger option, because new or unusual executable formats are blocked without you having to know them. It also needs more upkeep: every file type a team really uses has to be on it. An exclusion list is easier to start with, for example exe,bat,cmd,com,msi,ps1,vbs,js,jar,scr.

Renaming virus.exe to virus.pdf defeats an extension check on its own. MIME type validation compares the file content with its extension and closes that gap, and secure filename validation rejects tricks like double extensions.

1. Decide between allow list and exclusion list. Leave glide.attachment.extensions blank if you go with an exclusion list, because blank means all extensions are allowed.
2. Keep glide.security.file.mime_type.validation on true (the default) so uploads are checked against their real content.
3. Turn on glide.attachment.enable_secure_filename_validation and glide.security.file.mime_type.validation.inbound_email after a test, so filenames and email attachments get the same checks.
4. If you use Studio with Git, do not block txt or gitdata, or the MIME types text/plain and application/octet-stream. Git operations save those as attachments.
5. Test an upload of a blocked file through the form, Service Portal, a workspace and inbound email. Each channel can behave differently.

Limit attachment size

com.glide.attachment.max_size is the platform wide upload limit in megabytes. The delivered value is 1024, so files up to 1 GB are accepted. Most organizations go much lower, often between 25 and 100 MB.

Several features have their own, smaller limit on top. Catalog attachment variables default to 20 MB, guest uploads in chat to 10 MB, Visual Task Boards to 10 MB. The platform limit always applies as well, so a feature limit can only make things stricter in practice.

Email has separate limits in bytes, both for the total size and the number of attachments. Attachments over these limits are dropped, not rejected, so the email itself still arrives.

1. Set com.glide.attachment.max_size to the largest file a user really needs, in MB.
2. Check the feature limits below for the areas you use, and align them with the platform limit so users get a consistent answer.
3. For a single catalog variable, set the max_file_size variable attribute instead of changing the default for all variables.
4. Upload a file just over the new limit to confirm the error message users will see.

Control downloads and previews

Opening an uploaded HTML or SVG file directly in the browser is a cross site scripting risk, because the file runs on your instance's domain. With glide.ui.attachment.force_download_all_mime_types on true (the default), every attachment downloads instead of rendering inline. glide.ui.attachment.download_mime_types lists the types that always download, even when that switch is off.

Previews are a separate topic. The workspace document viewer only previews the MIME types listed in sn_now_record_form.u_SupportedFileTypesForAttachmentPreview. The delivered list covers images, text, PDF and Office files, but no audio or video, so an mp3 shows no preview until you add audio/mpeg.

1. Keep glide.ui.attachment.force_download_all_mime_types on true unless you have a clear need for inline rendering.
2. If you switch it off, make sure text/html, image/svg+xml and application/xml stay in glide.ui.attachment.download_mime_types.
3. To preview more types in workspaces, add their MIME types to the document viewer list, separated by commas.
4. Use glide.activity.attachment_preview to show only title and size in the activity stream instead of a preview.

Who can attach, and API access

glide.attachment.role lists the roles that may create attachments. The delivered value public lets every user attach files, including portal users. Narrowing it is a quick way to stop uploads from groups that never need them.

Attachments are also reachable through the REST Attachment API. Read access follows the ACLs of the parent record, but glide.rest.attachment_api.enforce_authentication makes sure requests without a session are rejected outright.

1. Replace public in glide.attachment.role with the roles that need to attach, for example itil,snc_internal. Check portal and external users first.
2. Set glide.rest.attachment_api.enforce_authentication to true and test integrations that read or write attachments.
3. Turn on glide.sg.block_mobile_attachments_sharing if attachments must not leave the mobile app.

Check your instance

Paste this read-only background script into System Definition > Scripts - Background on a sub-production instance. It prints the current value of every property in this guide. A property without a record runs on its platform default. You can also open sys_properties.list and filter by name.

// Read only: prints the current value of every property in this guide.
// Run in System Definition > Scripts - Background.
var names = [
  'glide.attachment.extensions',
  'glide.security.attachment_type.use_blacklist',
  'glide.attachment.blacklisted.extensions',
  'glide.attachment.blacklisted.types',
  'glide.security.file.mime_type.validation',
  'glide.attachment.enable_secure_filename_validation',
  'glide.attachment.enforce_security_validation',
  'glide.security.file.mime_type.validation.inbound_email',
  'glide.security.mime_type.aliasset',
  'glide.attachment.trusted_system_extensions',
  'com.glide.attachment.max_size',
  'glide.sc.variable.attachment.default_max_size',
  'com.glide.cs.upload.attachment.max_size',
  'vtb.board.upload_limit',
  'sn_hr_ef.max_file_size',
  'com.glide.attachment.max_get_size',
  'glide.email.inbound.max_total_attachment_size_bytes',
  'glide.email.outbound.max_total_attachment_size_bytes',
  'glide.email.inbound.max_attachment_count',
  'glide.email.outbound.max_attachment_count',
  'glide.ui.attachment.force_download_all_mime_types',
  'glide.ui.attachment.download_mime_types',
  'glide.ui.attachment.admin_scs_download_mime_types',
  'sn_now_record_form.u_SupportedFileTypesForAttachmentPreview',
  'glide.activity.attachment_preview',
  'glide.ui.strict_customer_uploaded_static_content',
  'glide.ui.strict_customer_uploaded_content_types',
  'glide.ui.attachment_popup',
  'glide.ui.disable_attachment_view',
  'glide.attachment.role',
  'glide.rest.attachment_api.enforce_authentication',
  'glide.rest.attachment_csm_api.allowed_tables',
  'glide.sg.block_mobile_attachments_sharing',
  'glide.ui.attachment_drag_and_drop',
  'glide.import.file.extension_whitelist'
];
var found = {};
var gr = new GlideRecord('sys_properties');
gr.addQuery('name', 'IN', names.join(','));
gr.query();
while (gr.next()) {
  found[gr.getValue('name')] = gr.getValue('value');
}
for (var i = 0; i < names.length; i++) {
  var n = names[i];
  gs.print(n + ' = ' + (found.hasOwnProperty(n) ? found[n] : '(no record on this instance, platform default applies)'));
}

FAQ

Related