Strapi Clam AV Upload Provider Proxy

A Strapi upload provider proxy which will:

• Scan any file any user attempts to upload with Clam AV and reject if infected
• Optionally throw if GIF contains XSS attack
• Optionally remove XSS attack code from SVG type images
• Optionally remove XSS attack code from JPEG image EXIF fields

Before passing off upload to whichever other strapi-provider is appropriate for your use-case.

Configuration

This plugin acts as a piggy-back onto whatever upload provider you would normally use.

Specify that provider in the uploadProvider option and then specify that providers options in-line with the clamav-proxy settings

e.g. config/plugins.js

module.exports = {
  ...
  upload: {
    provider: 'strapi-provider-upload-clamav-proxy',
    providerOptions: {
      clamav: {
        host: 'my.clamav.host',
        port: 3310,
        timeout: 3000
      },
      sanitize: {
        svg: true,
        jpeg: true,
        gif: true
      },
      // Proxied provider
      uploadProvider: '@strapi/provider-upload-local',
      sizeLimit: 100000
    }
  }
}

Where:

| Name | Type | Description | | -------------------------------- | -------- | --------------------------------------------------------------- | | provider | Constant | "clamav-proxy" - The name of this provider | | providerOptions.clamav.host | String | The hostname/ip of a ClamAV instance (default 127.0.0.1) | | providerOptions.clamav.post | Number | The port on which that ClamAV instance runs (default 3310) | | providerOptions.clamav.timeout | Number | Clam AV timeout - ms (default 3000) | | providerOptions.sanitize.svg | Boolean | Sanitize SVG files? | | providerOptions.sanitize.jpeg | Boolean | Sanitize JPEG files? | | providerOptions.sanitize.gif | Boolean | Throw an error if GIF file is infected with an XSS attack | | | providerOptions.uploadProvider | String | Any valid upload provider (e.g. strapi-provider-upload-local) | | providerOptions.* | Any | Any valid upload provider option |