Approach for antivirus scanning of files before upload

[BradNut]

In the current implementation any file upload using the storage provider will directly upload to the Minio instance. While this is fine if we trust everything uploaded that is usually not the case in a production application.

In past companies we have used a ClavAV server to scan before allowing items to be uploaded. Another approach I have seen is allowing all items to be uploaded but using ClamAV to scan the directories and quarantining the items.

Is there any merit in stating in the project that you should probably look into using an AV scanner? Anyone have a suggested flow to do this in the current stack?

[Rykuno]

Yeah i've done this before, but its kinda situational imho. I believe IF you felt the need for an AV scanner, like for corporate compliance or whatever, then its best to have this on some separate process and run on a cron or trigger.

AV scanners like Clav take up metric tons of resources and will bottleneck you rather hard. It also will spike usage like crazy when doing its daily update or whatever; its unpredictable 😆.

Idk the best way but I can describe how we've done in the past,

1. User uploads file that gets stored into a pre-scan bucket.
2. ClavAV(or whatever av) is run on its own vps/process and will scan it on a trigger or cron job.
3. After completion it gets moved into your default storage bucket where its made publicly available or processable.

[BradNut]

Alright thank you for your response! Yeah Clamav will take a lot of resources but alternative external services are quite limiting, e.g. Virustotal 4 requests/minute.

In my case I have uploads that can happen from both authenticated and non-authenticated flows. So an AV seems appropriate given anyone could go in and try to mess with the system. I'm just trying to follow the basic OWASP file upload cheatsheet given the open nature of my scenarios.