How to scan and remove maclious file when uploading?

Question

When uploading malicious file in this time need scanning and remove that file. any special package is there in NPM? Can you help me on this any one thanks advance.

Answer 1

Following 2 steps are basic steps.

1. In frontend only allow specific file extensions like(.pdf,.png etc.) with limitations like size. (Don't forget front end code can be manipulated).

2.You shoul also need to check file extenstions & sizes in backend(if you are using node you can use multer to achieve this.)

What more we can do in backend?

1. If we only rely on checking with extensions it doesn't help. (anyone can modify name of sample.exe to sample.jpg & upload).

For example if you check whether file uploaded image or not in backend other than checking with file extension you can follow below approach also.

The first eight bytes of a PNG file always contain the following (decimal) values: 137 80 78 71 13 10 26 10

If you want to check whether uploaded file is png or not above condition will work. Not only that if you want to check files uploaded properly or not you can follow some approaches like mentioned above. (for .pdf, .doc some rules might be there) You can check MIME signature data which is the best practice.

2. Don't save uploaded files in backend code repository. Store them some other workspace. (optional)

Following links might help.

Cloud Storages

Other than storing files in local server you can save uploaded files on cloud like amazon s3 bucket. After every time any file is uploaded to that s3 bucket you can trigger scanner using lambdas(automatic file scanners on amazon).

Other than amazon you can also use google drive for files upload (not optimal one). But when someone downloads uploaded file google will automatically scan for viruses.

amazon's s3 bucket file's scan links::

amazon s3 bucket files scan SO

amazon s3 bucket files reddit

s3 files scanning using lambda & clamav

For local server::

checking MIME signature offical docs

check file types plugin

clam scan npm

check image content without extension SO 1

check image content without extensions SO 2