sunspikes / clamav-validator

Laravel virus validator based on ClamAV anti-virus scanner

ClamAV Virus Validator For Laravel

A custom Laravel virus validator based on ClamAV anti-virus scanner for file uploads.

• Requirements
• Installation
• Usage
• Author

Requirements

You must have ClamAV anti-virus scanner running on the server to make this package work.

You can see the ClamAV installation instructions on the official ClamAV documentation.

For example on an Ubuntu machine, you can do:

# Install clamav virus scanner
sudo apt-get update && sudo apt-get install -y clamav-daemon

# Update virus definitions
sudo freshclam

# Start the scanner service
sudo systemctl enable --now clamav-daemon clamav-freshclam

This package is not tested on Windows, but if you have ClamAV running (usually on port 3310) it should work. You will also need to have sockets extension installed and enabled (all executions without this module will fail with this error - "Use of undefined constant 'AF_INET'").

Installation

1. Install the package through Composer.

$ composer require sunspikes/clamav-validator

2. Add the service provider (for Laravel 5.4 or below)

This package supports Laravel new Package Discovery.

If you are using Laravel < 5.5, you need to add Sunspikes\ClamavValidator\ClamavValidatorServiceProvider::class to your providers array in config/app.php:

'providers' => [
	// ...

	Sunspikes\ClamavValidator\ClamavValidatorServiceProvider::class,
],

3. Publish assets from the vendor package

Config file

The default configuration file does use ENV to override the defaults. If you want to change the configuration file anyway you run the following command to publish the package config file:

php artisan vendor:publish --provider="Sunspikes\ClamavValidator\ClamavValidatorServiceProvider" --tag=config

Once the command is finished you should have a config/clamav.php file that will be used as well.

Language files

If you want to customize the translation or add your own language you can run the following command to publish the language files to a folder you maintain:

php artisan vendor:publish --provider="Sunspikes\ClamavValidator\ClamavValidatorServiceProvider" --tag=lang

This will copy the language files to resources/lang/vendor/clamav-validator for Laravel >= 5.1

Usage

Use it like any Validator rule:

$rules = [
    'file' => 'clamav',
];

ClamavValidator will automatically run multiple files one-by-one through ClamAV in case file represent multiple uploaded files.

Author

Krishnaprasad MG [@sunspikes] and other awesome contributors

clamav-validator's Issues

Can't install clamav-validator

Can't install clamav-validator by : composer require sunspikes/clamav-validator in laravel 5.8

Nothing is shown when malware is found

I have tried using an Eicar file to test, even when the Clamav detects that there is malware it continues as normal.

Add support for Laravel 10

Is it possible to add support for illuminate/validation and illuminate/support ^10.0 now that Laravel 10 was released?

Method Illuminate\Validation\Validator::validateClamav does not exist.

if you remove the $this->app->runningInConsole() check in ClamavValidatorServiceProvider::boot() validation rules working again

Update quahog requirement

Package blurgroup/quahog is abandoned, you should avoid using it. Use xenolope/quahog instead.

https://packagist.org/packages/blurgroup/quahog

Eicar test signature and test sources folder

Hello,

We've been trying to use your package for ClamAV scanning in Laravel - which has been fantastic in helping us scan files automatically - but we've run into a few issues with the Eicar test signature being directly included in the package source.

This is often tripping out AV scanners both on developer machines when the package is pulled in and is likely to cause some frustration with IT security types receiving alerts for the test signature, and also triggering alerts on production servers when AV scanning and the package is deployed as part of a site.

Could you possibly consider perhaps exporting the package with the tests folder excluded (e.g. as Laravel does here in a .gitattributes with its tests folder - https://github.com/laravel/framework/blob/5.5/.gitattributes) so that the Eicar test signature isn't pulled down onto the machine when we use the package?

Open to any other suggestions also to help prevent the Eicar test signature from causing any false positives too.

Thanks for your help!

Timeout error on clamav validator

We are facing intermittent issue. We are getting error as below.

ClamAV scanner client failed with error "Timeout waiting to read response"

Any idea what is reason behind it ? sometime its working fine and sometime we are getting above error.

Feature Request: enable/disable for different env

Hi,

could you please put in a little functionality that enables/disables it on certain environments, e.g. we don't need it on local. So maybe a flag in the config file like 'enabled' => env('CLAMAV_ENABLED', true) that we can set via the .env file.

Thanks!

Compatibility with Laravel 9

Hi,

Any plans on adding compatibility with Laravel 9?

Thank you

Access denied Issue - Vagrant Homestead

Hey @sunspikes,

I tried your package. Sadly it does not work on vagrant homestead. Getting access denied.

PFA the screenshot of file permission of UploadedFIle ( phpAPPt0m ) in tmp folder.

It does not support multiple files in the same input

When I have an input that allows the upload of a single file it works fine, but when the input is multiple, it gives an error:
ErrorException: is_readable() expects parameter 1 to be a valid path, array given in /absolute/path/vendor/sunspikes/clamav-validator/src/ClamavValidator/ClamavValidator.php:52

Error when call test

  protected $translator;
   protected $clean_data;
   protected $virus_data;
   protected $error_data;
   protected $rules;
   protected $messages;
   public function setUp()
   {
       $this->translator = Mockery::mock(Translator::class);
       $this->translator->shouldReceive('get')->with('validation.custom.file.clamav')->andReturn('error');
       $this->translator->shouldReceive('get')->with('validation.attributes')->andReturn([]);
       $this->translator->shouldReceive('trans');
       $this->clean_data = [
           'file' => "/var/www/html/gardenannex/storage/logs/clamav_test.txt"
       ];
       $this->virus_data = [
           'file' => "/var/www/html/gardenannex/storage/logs/clamav_test.txt"
       ];
       $this->error_data = [
           'file' => "/var/www/html/gardenannex/storage/logs/clamav_test.txt"
       ];
       $this->messages = [];
       $config = new Config();
       $config->shouldReceive('get')->with('clamav.preferred_socket')->andReturn('unix_socket');
       $config->shouldReceive('get')->with('clamav.unix_socket')->andReturn('/var/run/clamd.scan/clamd.sock');
       $config->shouldReceive('get')->with('clamav.tcp_socket')->andReturn('tcp://127.0.0.1:3310');
       $config->shouldReceive('get')->with('clamav.socket_read_timeout')->andReturn(30);
       $config->shouldReceive('get')->with('clamav.skip_validation')->andReturn(false);
       $application = Mockery::mock(Application::class, ['make' => $config]);
       Facade::setFacadeApplication($application);
   }

 ```

public function scan() {
$this->setUp();
$validator = new ClamavValidator(
$this->translator,
$this->clean_data,
['file' => 'clamav'],
$this->messages
);
$this->assertTrue($validator->passes())
}

}

Error: 

`Fatal error: Uncaught Mockery\Exception\NoMatchingExpectationException: No matching handler found for Mockery_1_Illuminate_Config_Repository::get('app.debug', NULL). Either the method was unexpected or its arguments matched no expected argument list for this method in D:\EYEGLASSES\Source\gardenannex\vendor\mockery\mockery\library\Mockery\ExpectationDirector.php:92 Stack trace: #0 D:\EYEGLASSES\Source\gardenannex\vendor\mockery\mockery\library\Mockery\Loader\EvalLoader.php(34) : eval()'d code(868): Mockery\ExpectationDirector->call(Array) #1 D:\EYEGLASSES\Source\gardenannex\vendor\mockery\mockery\library\Mockery\Loader\EvalLoader.php(34) : eval()'d code(974): Mockery_1_Illuminate_Config_Repository->_mockery_handleMethodCall('get', Array) #2 D:\EYEGLASSES\Source\gardenannex\vendor\laravel\framework\src\Illuminate\Foundation\helpers.php(283): Mockery_1_Illuminate_Config_Repository->get('app.debug', NULL) #3 D:\EYEGLASSES\Source\gardenannex\vendor\laravel\framework\src\Illuminate\Foundation\Exceptions\Handler.php(284): c in D:\EYEGLASSES\Source\gardenannex\vendor\mockery\mockery\library\Mockery\ExpectationDirector.php on line 92`

Laravel 6.0 support

Hi,

Could you please update this package's dependency to Laravel 6.0. Current this package requires illuminate/validation ^5.0.
Best regards,

allow passing stream directly to scanner

Hey!

Is there a chance the pull request #68 could be merged and tagged ? :)

Best Regards

Laravel 11 not supported

Hey there @sunspikes and the other contributors,
first and foremost thank you for this great package.

In my free time today I wanted to wrap my head around updating my projects to Laravel 11 and one of them is using clamav-validator. In this specific project the package is the only one that prevents me from upgrading, so I thought I would ask nicely for this simple change to be made.

I looked at the commit enabling Laravel 10 support by @ashleyshenton and it was "just" updating the composer dependencies.

To not come off as lazy, demanding or unprepared I did my fair share: Cloned this project, updated the composer.json to use the necessary versions of the conflicting packages, implemented it as a local package in my project and tested if anything breaks. I am glad that it still works like a charm for me in my - now - Laravel 11 application.

"illuminate/support": "~5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.0",
"illuminate/validation": "~5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.0 || ^10.0 || ^11.0"

We just need to update these to lines in the composer.json, like the time Laravel 10 support was implemented.

Any heroes out there?

Clamav-Validator fails every Upload

Hi,

I'm using Clamav-Validator on an Ubuntu-Machine with Laravel 5.2, but the Validator fails every Upload with the Standard-Error-Message from the Validator.

Do you have a hint to hunt the Problem down? ;-)

Thanks in Advance!
Carsten

All uploaded files are found to be infested (when in fact they really aren't)

When validating files that are uploaded via AJAX (through FormData), the validation says that they all have viruses.

Note: I did scan the files with clamscan to see if they are indeed infested, but none came back positive.

Access denied

Hello, I'm trying to use the Validator. But I'm getting a false positives. If i dd($result); inside of the validator, this is what I get:

array:3 [
  "filename" => "/tmp/php35EYkO"
  "reason" => "Access denied."
  "status" => "ERROR"
]

Would you know why? Thanks.

How to use this package in Docker environment ?

Hello ,

I am trying to use your package in the docker environment.

Is there any tutorial available?

Please help me.

Publishing translation files doesn't work

Issue

Running php artisan vendor:publish --provider="Sunspikes\ClamavValidator\ClamavValidatorServiceProvider" --tag=lang does not publish the language translation file to the correct location.

To reproduce

1. Install sunspikes/clamav-validator with Composer
2. Publish the language file with the above Artisan invocation
3. Observe that there is no clamav-validator directory under resources/lang/vendor

Expectation

The language file should be published to resources/lang/vendor/clamav-validator/en/validation.php.

Caveats

I already had a non-vendor translation file called validation.php in resources/lang/en — attempting to publish the language file for this package did not overwrite it, but I suspect that if it were not present, then the clamav-validator language file would have been copied here.

Call to undefined method Laravel\Lumen\Application::configPath()

Call to undefined method Laravel\Lumen\Application::configPath();
in ClamavValidatorServiceProvider.php line 38
In lumen 5.6 , i have this issue

Unresolvable dependency error?

Is it just me? ! can't figure this out. When I try to validate, I get this error:

local.ERROR: Unresolvable dependency resolving [Parameter #1 [ <required> array $data ]] in class Sunspikes\ClamavValidator\ClamavValidator {"userId":1077,"exception":"[object] (Illuminate\\Contracts\\Container\\BindingResolutionException(code: 0): Unresolvable dependency resolving [Parameter #1 [ <required> array $data ]] in class Sunspikes\\ClamavValidator\\ClamavValidator at /Users/baconcheesefry/code/ib_laravel/vendor/laravel/framework/src/Illuminate/Container/Container.php:1108)
[stacktrace]

Method Sunspikes\ClamavValidator\ClamavValidator::validateStatus does not exist.

I can't really describe how, but from now where this error has started to show up.

Does anyone knows how to fix it?

Thanks

Method Illuminate\Validation\Validator::validateClamav does not exist. (Laravel 7)

After update to Laravel 7 I'm get this error ( Method Illuminate\Validation\Validator::validateClamav does not exist.) Everything worked fine on laravel 6! Can you guess what the problem is?

Method Sunspikes\ClamavValidator\ClamavValidator::validateColorHex does not exist.

Just like in #19 I have trouble using this extension. If used with for example this extension https://github.com/Kaishiyoku/laravel-color-validation and the form validation rule is just ['required', 'color_hex'] I get the following error:

BadMethodCallException
Method Sunspikes\ClamavValidator\ClamavValidator::validateColorHex does not exist.

ClamAV scanner client failed with error "Socket operation failed: Connection reset by peer (SOCKET_ECONNRESET)"

Hi, I tried to upload file which size 400MB, then I got this error.
If I upload lower size files, there's no problem.
What should I change to avoid this error?

Debian 9

I've installed Clamav using these Docker commands:

RUN freshclam
RUN service clamav-daemon start

However my Laravel code can't find the socket, even though I've told it to look at /var/run/clamav/clamd.ctl.

Laravel error: Socket operation failed: Connection refused (SOCKET_ECONNREFUSED)

Any suggestions?

socket connect timeout should also be configurable.

Just like clamav.socket_read_timeout, also we should have clamav.socket_connect_timeout for socket connection timeout.

Errors should not always throw exceptions

Exceptions thrown from this validator hides related validation failures.

Example, user uploads a file that is too large for clamav (> 25Mb). ClamAV will close the
stream once it hits it's own configured limit. Throwing an exception in this case will show
the user a 500 internal error (production environment), instead of showing a useful message (the file size
validation error in the upload form).

how i use this package out of validator ?

hi . i have file manager and i want use event uploaded file , in bellow code after file uploaded i want scan it with calmAv

please help me thank you

\Event::listen('Alexusmai\LaravelFileManager\Events\FilesUploaded',
    function ($event) {
        \Log::info('FilesUploaded:', [
            $event->disk(),
            $event->path(),
            $event->files(),
            $event->overwrite(),
        ]);
    }
);

top code return

[2021-07-21 15:02:43] local.INFO: FilesUploading: ["public","",[{"name":"WhatsApp Image 2021-07-06 at 19.22.59 (1).jpeg","path":"/WhatsApp Image 2021-07-06 at 19.22.59 (1).jpeg","extension":"jpg"}],false]

i have disk and path , then i can get full path of file , now i need to validate path of file with calmav-validator

Performance when scanning

This is not an issue as such, but I’m just curious... how long does it take to scan the uploaded file? I’m wondering about the performance impact.

Thanks!

Working with Laravel Vapor

Hi there!

Any chance someone figured out how to make it work on Vapor? I was able to install the Clamav packages on the server but not start the daemon.

I know this is not directly related to the package, but that seems to be the better place to talk about Clamav and Laravel.

Thanks !

Ed

Merging L5 support from fork

@sunspikes
@lenrsmith implemented support for Laravel 5 and it seems to work with the new Laravel 5.1 LTS version (see the forks list).

Pls merge his changes to your repo so the support for L5 is available on packalyst and packagist

ClamAV scanner client failed with error "Socket operation failed: Connection refused (SOCKET_ECONNREFUSED)"

ClamAV scanner client failed with error "Socket operation failed: Connection refused (SOCKET_ECONNREFUSED)" while validating the file upload i am getting this issue

not compatible with laravel 5.1.23

i get the following:

BadMethodCallException in compiled.php line 4972:
Call to undefined method [package]
in compiled.php line 4972
at ServiceProvider->__call('package', array('sunspikes/clamav-validator', 'clamav-validator')) in ClamavValidatorServiceProvider.php line 31
at ClamavValidatorServiceProvider->package('sunspikes/clamav-validator', 'clamav-validator') in ClamavValidatorServiceProvider.php line 31
at ClamavValidatorServiceProvider->boot()
at call_user_func_array(array(object(ClamavValidatorServiceProvider), 'boot'), array()) in compiled.php line 1181
at Container->call(array(object(ClamavValidatorServiceProvider), 'boot')) in compiled.php line 1799
at Application->bootProvider(object(ClamavValidatorServiceProvider)) in compiled.php line 1791
at Application->Illuminate\Foundation{closure}(object(ClamavValidatorServiceProvider), '23')
at array_walk(array(object(EventServiceProvider), object(RoutingServiceProvider), object(AuthServiceProvider), object(ControllerServiceProvider), object(CookieServiceProvider), object(DatabaseServiceProvider), object(EncryptionServiceProvider), object(FilesystemServiceProvider), object(FormRequestServiceProvider), object(FoundationServiceProvider), object(PaginationServiceProvider), object(SessionServiceProvider), object(ValidationServiceProvider), object(ViewServiceProvider), object(HoneypotServiceProvider), object(ValidationServiceProvider), object(EntrustServiceProvider), object(ServiceProvider), object(AppServiceProvider), object(AuthServiceProvider), object(EventServiceProvider), object(RouteServiceProvider), object(CashierServiceProvider), object(ClamavValidatorServiceProvider), object(TranslationServiceProvider)), object(Closure)) in compiled.php line 1792
at Application->boot() in compiled.php line 2133
at BootProviders->bootstrap(object(CmmApp)) in compiled.php line 1578
at Application->bootstrapWith(array('Illuminate\Foundation\Bootstrap\DetectEnvironment', 'Illuminate\Foundation\Bootstrap\LoadConfiguration', 'Illuminate\Foundation\Bootstrap\ConfigureLogging', 'Illuminate\Foundation\Bootstrap\HandleExceptions', 'Illuminate\Foundation\Bootstrap\RegisterFacades', 'Illuminate\Foundation\Bootstrap\RegisterProviders', 'Illuminate\Foundation\Bootstrap\BootProviders')) in compiled.php line 2297
at Kernel->bootstrap() in compiled.php line 2250
at Kernel->sendRequestThroughRouter(object(Request)) in compiled.php line 2234
at Kernel->handle(object(Request)) in index.php line 54

Method [validateClamav] does not exist.

Am using Laravel 5.5, and get this error when trying to use clamav as a validator. I have installed the package, and added it to app/config.php as a provider.

Add option for on-demand scan instead of daemon

Feature request:

Since the validation is an on-demand function, there is little value in using the daemon.

Calling clamav on instead on-demand follows a more coherent architecture.

This would reduce the idle memory footprint by ~250MB per instance for monolithic apps.

Validation fails when upload any file

the exception is

Socket operation failed: An existing connection was forcibly closed by the remote host

i have bun in production server

[2021-07-23 14:10:31] local.ERROR: ClamAV scanner client failed with error "file_exists(): open_basedir restriction in effect. File(/var/run/clamav/clamd.ctl) is not within the allowed path(s): (/home/gandom/:/tmp/:/var/tmp/:/opt/alt/php74/usr/share/pear/:/dev/urandom:/usr/local/php74/lib/:/usr/local/php74/lib/:/usr/local/php73/lib/:/usr/local/lib/php/)" {"userId":1,"exception":"[object] (Sunspikes\ClamavValidator\ClamavValidatorException(code: 0): ClamAV scanner client failed with error "file_exists(): open_basedir restriction in effect. File(/var/run/clamav/clamd.ctl) is not within the allowed path(s): (/home/gandom/:/tmp/:/var/tmp/:/opt/alt/php74/usr/share/pear/:/dev/urandom:/usr/local/php74/lib/:/usr/local/php74/lib/:/usr/local/php73/lib/:/usr/local/lib/php/)" at /home/gandom/domains/gandom.click/public_html/vendor/sunspikes/clamav-validator/src/ClamavValidator/ClamavValidatorException.php:39)

i fallow this tutorial

https://techservicedoc.com/how-to-install-clamav-antivirus-tool-on-rhel-centos-7/