Skip to content

Conversation

@DanielMadsenDK
Copy link
Contributor

PR Description:

The CommandInjectionChecker is a ServiceNow Script Include designed to detect potential command injection attacks in user-supplied strings. It scans for common shell metacharacters and patterns (e.g., ;, |, &, $(), `) using regex, providing a boolean result to flag suspicious inputs. This utility enhances security in server-side automation without relying on external libraries, following ServiceNow best practices for input validation.

Example on how to use it:

var checker = new CommandInjectionChecker();

// Safe input
if (!checker.containsCommandInjection('Normal text')) {
gs.info('Input is clean.');
}

// Suspicious input
if (checker.containsCommandInjection('ls; rm -rf /')) {
gs.error('Command injection detected - blocking action.');
}

Pull Request Checklist

Overview

  • Put an x inside of the square brackets to check each item.
  • I have read and understood the CONTRIBUTING.md guidelines
  • My pull request has a descriptive title that accurately reflects the changes and the description has been filled in above.
  • I've included only files relevant to the changes described in the PR title and description
  • I've created a new branch in my forked repository for this contribution

Code Quality

  • My code is relevant to ServiceNow developers
  • My code snippets expand meaningfully on official ServiceNow documentation (if applicable)
  • I've disclosed use of ES2021 features (if applicable)
  • I've tested my code snippets in a ServiceNow environment (where possible)

Repository Structure Compliance

  • I've placed my code snippet(s) in one of the required top-level categories:
    • Core ServiceNow APIs/
    • Server-Side Components/
    • Client-Side Components/
    • Modern Development/
    • Integration/
    • Specialized Areas/
  • I've used appropriate sub-categories within the top-level categories
  • Each code snippet has its own folder with a descriptive name

Documentation

  • I've included a README.md file for each code snippet
  • The README.md includes:
    • Description of the code snippet functionality
    • Usage instructions or examples
    • Any prerequisites or dependencies
    • (Optional) Screenshots or diagrams if helpful

Restrictions

  • My PR does not include XML exports of ServiceNow records
  • My PR does not contain sensitive information (passwords, API keys, tokens)
  • My PR does not include changes that fall outside the described scope

@am-shakeel am-shakeel self-assigned this Oct 19, 2025
Copy link
Contributor

@am-shakeel am-shakeel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good

@am-shakeel am-shakeel merged commit 79011a2 into ServiceNowDevProgram:main Oct 19, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants