ClamAV

[gedw99]

I need to allow users to upload wasm plus sone text and image files .

I have sone control on the client side about what they can upload.

my worry is that they can load malicious files .

I do image transformation and video transcode

Approaches to not getting hacked ?

1. Client side scanning . Client is golang so could reuse code.
2. server side scanning with Clamav. I presume the WAF has a ClanAV feature ?
3. Do ALL image transform and video transform using golang wasm. Not possible though without tons of effort and terrible perf
4. When I run the main wasm code it uses the video and images , so at this later if the architecture it’s sandboxes so anything nasties n an uploaded image would be sandboxed ?

If anyone has any words of wisedom on how to approach these cross cutting aspect I am all ears.

I am using caddy and WAF plugin.
I am combining that with The caddy security plugin t control access at a folder level

[jptosso]

Hey @gedw99 I have seen cases of modsec + clamAV, I will run some experiments using Caddy and get back to you. In theory this should work: https://malware.expert/scan-every-file-clam-antivirus-scanner-modsecurity/

[gulywwx]

we are looking for the solution of Haproxy+coraza-spoa+clamAV. But
SecRule FILES_TMPNAMES "@inspectFile clamav.sh" "phase:2,id:1,t:none,log,deny,msg:'Virus found in uploaded file'" is not picked up by coraza.

any ideal?

[security-database]

Hello everyone! For someone who also surfed here.

I was also interested in this, but found that maximum frame size between haproxy and spoe filter is 16380 bytes.

To increase it is required to change tun.bufsize and edit this maxFrameSize to higher numbers.

Hello @blacky-i , @gulywwx i'm also trying to use coraza-spoa to scan files and/or body but without luck. Can you be a little bit more specific on the filter tun.bufsize.

Thanks a lot

[blacky-i]

Hello! Sure.

First it is required to set higher tune.bufsize,upper limit is 256mb

In this file of coraza spoa

Second, spoa-agent must be rebuilt with lower or equal value, which you will set in haproxy.cfg file

[security-database]

Hello! Sure.

First it is required to set higher tune.bufsize,upper limit is 256mb

In this file of coraza spoa

Second, spoa-agent must be rebuilt with lower or equal value, which you will set in haproxy.cfg file

Thanks a Million, understand what you say ;)

Have you try https://github.com/coreruleset/antivirus-plugin ? (with disable MODSEC_BUILD)
Do you think it's due to the tun.bufsize ? (16Kb is normally large enough to test with an eicar signature) ... but actually unable to use it (no file to push to the antivirus)

[blacky-i]

I was testing with calmav installed and .sh script with eicar signature gzip archives. If you interested, I can find a repo and send later on next week

[security-database]

I was testing with calmav installed and .sh script with eicar signature gzip archives. If you interested, I can find a repo and send later on next week

Please, i will look at it! Thanks a lot