Allow for virus inspection of specific file types

[Luminarys]

On files which have a MIME type of exectuable or binary, trigger a virus scan and potentially add the file to the banned file list if there's a match(this cab be detected by checking if the file gets removed by the scan).

[Guad]

What virus scanner do you suggest?

[Luminarys]

I'll handle that, right now I'm using clamd. Basically it should be called with popen and run on binary/executables, and if the file gets removed, it should be added to the banned list and rejection method should be returned.
On Jun 23, 2015 5:55 PM, Guad notifications@github.com wrote:What virus scanner do you suggest?

—Reply to this email directly or view it on GitHub.

[Luminarys]

The exe/dll/com ending scans should be fine for now, but MIME based detection of executables would be optimal. Also, we should write a function which takes a list of files to ban, adds their hashes, names, etc. to the banlist and deletes them all. I'm doing this at the moment.

[Guad]

Alright

[Luminarys]

Are we using detection based on MIME types?

[Guad]

Wouldn't application/octet-stream give a lot of non executables?

[Luminarys]

Does windows run files which don't have an exe extension? It shouldn't be a big deal though, I have a cron job running virus scans every 24 hours, I'll just have it update the banlist when it runs.

[Guad]

An attacker could upload his payload under any extension and then rename it after downloading it and execute it on a victim's computer. Virus scans should be enough I guess.

[Luminarys]

I don't know how good the MIME type detection is for flask, but the idea is to detect any binary/executable type and scan it regardless of extension/file name. This can be something to be changed down the road though; for now it should be fine.

[Guad]

You can test it yourself, just add print(file.content_type)