---
title: UI Scripts Rules
description: "The below table shows the list of ServiceNow UI scripts rules that are checked by Quality Clouds. See the [ServiceNow: UI scripts](https://docs.servicenow.com/bundle/newyork-application-development/page/script/client-scripts/concept/c_UIScripts.html)for designing and implementing client scripts. | Description | Severity | Area of impact | | --- | --- |…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/by-configuration-element/ui-scripts-rules/"
updated: "2025-03-21"
category: Rules for ServiceNow / By Configuration Element
---

# UI Scripts Rules

The below table shows the list of ServiceNow UI scripts rules that are checked by Quality Clouds.

See the [ServiceNow: UI scripts](https://docs.servicenow.com/bundle/newyork-application-development/page/script/client-scripts/concept/c_UIScripts.html)for designing and implementing client scripts.

| Description | Severity | Area of impact |
| --- | --- | --- |
| [Possible use of private data](https://qualityclouds.com/documentation/docs/qc/data-privacy-and-gdpr/possible-use-of-private-data/) | Warning | Security |
| [JavaScript - Avoid use of Function Constructors](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-use-of-function-constructors/) | High | Security |
| [JavaScript - Avoid use of WebDB](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-use-of-webdb/) | High | Security |
| [JavaScript - Avoid use of debugger statements](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-use-of-debugger-statements/) | High | Security |
| [JavaScript - Avoid unrestricted targetOrigin on cross-domain messaging](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-unrestricted-targetorigin-on-cross-domain-messaging/) | High | Security |
| [JavaScript - Avoid making connections on unsafe protocols](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-making-connections-on-unsafe-protocols/) | Warning | Security |
| [JavaScript - Avoid use of Eval function](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-use-of-eval-function/) | High | Security |
| [Javascript - Avoid use of alert function](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-use-of-alert-function/) | Low | Scalability |
| [Javascript - Avoid use of local storage on Client Scripts](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-avoid-use-of-local-storage-on-client-scripts/) | High | Security |
| [JavaScript - Optimize Loops](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-optimize-loops/) | Warning | Performance |
| [JavaScript - Use === comparison](https://qualityclouds.com/documentation/docs/qc/javascript-rules/javascript-use-comparison/) | Warning | Manageability |
| [AngularJS - Denial of Service attack through DOM clobbering on versions under 1.6.3](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/angularjs-denial-of-service-attack-through-dom-clobbering-on-versions-under-1-6-3/) | High | Security |
| [AngularJS - Prototype Pollution Vulnerability under 1.7.9](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/angularjs-prototype-pollution-vulnerability-under-1-7-9/) | High | Security |
| [AngularJS - XSS vulnerability through the attribute "usemap" from 1.0.0 to 1.2.30](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/angularjs-xss-vulnerability-through-the-attribute-usemap-from-1-0-0-to-1-2-30/) | High | Security |
| [AngularJS - XSS vulnerability through the attribute "usemap" from 1.3.0 to 1.5.0-rc2](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/angularjs-xss-vulnerability-through-the-attribute-usemap-from-1-3-0-to-1-5-0-rc2/) | High | Security |
| [AngularJS - XSS vulnerability under 1.8.0 - input HTML](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/angularjs-xss-vulnerability-under-1-8-0-input-html/) | High | Security |
| [AngularJS - XSS vulnerability using AngularJS under 1.6.5 in Firefox and Safari - sanitize on inert Documents](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/angularjs-xss-vulnerability-using-angularjs-under-1-6-5-in-firefox-and-safari-sanitize-on-inert-documents/) | High | Security |
| [AngularJS - XSS vulnerability using AngularJS under 1.6.9 with Firefox](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/angularjs-xss-vulnerability-using-angularjs-under-1-6-9-with-firefox/) | High | Security |
| [jQuery - Prototype Pollution Vulnerability under 3.4.0](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-prototype-pollution-vulnerability-under-3-4-0/) | High | Security |
| [jQuery - XSS vulnerability under 1.6.3, when using location.hash](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-xss-vulnerability-under-1-6-3-when-using-location-hash/) | High | Security |
| [jQuery - XSS vulnerability under 1.9.0, when using jQuery(strInput)](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-xss-vulnerability-under-1-9-0-when-using-jquerystrinput/) | High | Security |
| [jQuery - XSS vulnerability under 3.0.0, when making cross-domain calls without the dataType option](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-xss-vulnerability-under-3-0-0-when-making-cross-domain-calls-without-the-datatype-option/) | High | Security |
| [jQuery - XSS vulnerability under 3.5.0, when using htmlPrefilter](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-xss-vulnerability-under-3-5-0-when-using-htmlprefilter/) | High | Security |
| [jQuery-ui-dialog - XSS vulnerability under 1.10.0, closeText parameter](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-ui-dialog-xss-vulnerability-under-1-10-0-closetext-parameter/) | High | Security |
| [jQuery-ui-dialog - XSS vulnerability under 1.10.0, title attribute](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-ui-dialog-xss-vulnerability-under-1-10-0-title-attribute/) | High | Security |
| [jQuery-ui-tooltip - XSS vulnerability under 1.10.0, title attribute](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/jquery-ui-tooltip-xss-vulnerability-under-1-10-0-title-attribute/) | High | Security |
| [moment.js - Regular Expression Denial of Service Vulnerability](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/moment-js-regular-expression-denial-of-service-vulnerability/) | High | Security |
| [XSS vulnerability in Ext JS Action Column getTip](https://qualityclouds.com/documentation/docs/qc/vulnerabilities-in-open-source-libraries/xss-vulnerability-in-ext-js-action-column-gettip/) | High | Security |
| [UI Scripts with hard-coded sys_ids](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/ui-scripts-with-hard-coded-sys_ids/) | Medium | Manageability |
| [Document Object Model (DOM) manipulation in UI Scripts](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/document-object-model-dom-manipulation-in-ui-scripts/) | High | Manageability |
| [Synchronous AJAX call in UI Scripts](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/synchronous-ajax-call-in-ui-scripts/) | High | Performance |
| [UI Scripts with the console.log debugging method](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/ui-scripts-with-the-console-log-debugging-method/) | Medium | Performance |
| [GlideRecord usage on UI Scripts](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/gliderecord-usage-on-ui-scripts/) | High | Performance |
| [UI Scripts with empty script field](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/ui-scripts-with-empty-script-field/) | Low | Performance |
| [Avoid Global UI Scripts](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/avoid-global-ui-scripts/) | Low | Performance |
| [UI Scripts without function](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/ui-scripts-without-function/) | Medium | Scalability |
| [UI Scripts including Open Source libraries](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/ui-scripts-including-open-source-libraries/) | Low | Performance |
| [Modified Out of the Box Element](https://qualityclouds.com/documentation/docs/qc/servicenow-rules/modified-out-of-the-box-element/) | Warning | Scalability |