ClamAV

[gedw99]

I need to allow users to upload wasm plus sone text and image files .

I have sone control on the client side about what they can upload.

my worry is that they can load malicious files .

I do image transformation and video transcode

Approaches to not getting hacked ?

1. Client side scanning . Client is golang so could reuse code.
2. server side scanning with Clamav. I presume the WAF has a ClanAV feature ?
3. Do ALL image transform and video transform using golang wasm. Not possible though without tons of effort and terrible perf
4. When I run the main wasm code it uses the video and images , so at this later if the architecture it’s sandboxes so anything nasties n an uploaded image would be sandboxed ?

If anyone has any words of wisedom on how to approach these cross cutting aspect I am all ears.

I am using caddy and WAF plugin.
I am combining that with The caddy security plugin t control access at a folder level

[jptosso]

Hey @gedw99 I have seen cases of modsec + clamAV, I will run some experiments using Caddy and get back to you. In theory this should work: https://malware.expert/scan-every-file-clam-antivirus-scanner-modsecurity/

[gulywwx]

we are looking for the solution of Haproxy+coraza-spoa+clamAV. But
SecRule FILES_TMPNAMES "@inspectFile clamav.sh" "phase:2,id:1,t:none,log,deny,msg:'Virus found in uploaded file'" is not picked up by coraza.

any ideal?

[jptosso]

Can you create an issue? This should be working according to the tests https://github.com/corazawaf/coraza/blob/main/internal/operators/inspect_file_test.go but I have never tried it.

[gulywwx]

Hey @jptosso , please ignore this issue. I am using coraza-spoa. It issue is caused when uploading a big file. It got EOF error before the inspect file operation. uploading a file less than 10k is working well. it may be haproxy issue.

[blacky-i]

Hello everyone! For someone who also surfed here.

I was also interested in this, but found that maximum frame size between haproxy and spoe filter is 16380 bytes.

To increase it is required to change tun.bufsize and edit this maxFrameSize to higher numbers.