Posted in: Security, ServiceNow

Dynamic filters and properties

I was trying to create a Dynamic filter in a ServiceNow instance that would allow anyone to filter things by users configured/listed in a property. In theory it was a straight forward thing to do and I proceeded to accomplish the task. But things soon turned into a struggle to not loose my sanity, knowing that what I have in code should work and it does so when run elsewhere, but not when used in a Dynamic filter. To top the frustration, for some reason logging from the same scripts does not usually work, nothing is added to the log; I say usually, because a couple of times – randomly, a log entry has been created (when calling gs.info() from within my script). In the end I have turned to the Sherlockian method (whatever remains blah, blah, blah) of finding the truth and came to the conclusion that for some reason neither gs.getProperty or GlideProperties.get() work when a script containing those is run as part of a Dynamic filter.

Eventually I have been told (thanks!) what is the explanation for this behavior – something I should have been very aware of: filters are evaluated in a restricted sandbox. Being restricted there are things not permitted and one of those is the use of the gs.getProperty API call. You can read more about it on ServiceNow’s docs page.

I have even tried doing a lookup of the property using a GlideRecord but that did not work either. Eventually I employed a total hack by which whenever the property changed, the script of the Dynamic filter got generated, so that the Dynamic filter script was just the echoing of a hard coded array of values.