feat(security): add ClamAV integration

README.md

@@ -111,6 +111,13 @@ A list of configuration options which you need
     The development setup features a minio service, implementing the S3 protocol.
     To use SSE-C in development make sure to generate a certificate for the minio container and set `ALEXANDRIA_S3_VERIFY` to `false`.
 
+- ClamAV
+- `ALEXANDRIA_CLAMD_ENABLED`: Set this to `True` to enable ClamAV (virus scanner).
+- `ALEXANDRIA_CLAMD_SOCKET`: ClamAV socket
+- `ALEXANDRIA_CLAMD_USE_TCP`: Use TCP to connect to ClamAV service
+- `ALEXANDRIA_CLAMD_TCP_SOCKET`: ClamAV service socket
+- `ALEXANDRIA_CLAMD_TCP_ADDR`: ClamAV service address
+
 For development, you can also set the following environemnt variables to help you:
 
 - `ALEXANDRIA_DEV_AUTH_BACKEND`: Set this to "true" to enable a fake auth backend that simulates an authenticated user. Requires `DEBUG` to be set to `True` as well.

alexandria/conftest.py

@@ -44,6 +44,11 @@ def _make_clean_media_dir(settings):
     shutil.rmtree(test_media_root)
 
 
+@pytest.fixture(autouse=True)
+def mock_clamd(mocker):
+    mocker.patch("django_clamd.validators.validate_file_infection", return_value=None)
+
+
 @pytest.fixture
 def admin_groups():
     return ["admin"]

alexandria/core/serializers.py

@@ -2,6 +2,7 @@
 from django.contrib.auth.models import AnonymousUser
 from django.template.defaultfilters import slugify
 from django.utils import translation
+from django_clamd.validators import validate_file_infection
 from generic_permissions.validation import ValidatorMixin
 from generic_permissions.visibilities import (
     VisibilityResourceRelatedField,
@@ -231,6 +232,10 @@ def is_valid(self, *args, raise_exception=False, **kwargs):
             self._prepare_multipart()
         return super().is_valid(*args, raise_exception=raise_exception, **kwargs)
 
+    def validate_content(self, value):
+        validate_file_infection(value)
+        return value
+
     class Meta:
         model = models.File
         fields = BaseSerializer.Meta.fields + (

alexandria/settings/alexandria.py

@@ -160,3 +160,10 @@ def default(default_dev=env.NOTSET, default_prod=env.NOTSET):
 
 # Checksums
 ALEXANDRIA_ENABLE_CHECKSUM = env.bool("ALEXANDRIA_ENABLE_CHECKSUM", default=True)
+
+# Clamav service
+CLAMD_SOCKET = env.str("ALEXANDRIA_CLAMD_SOCKET", default="/var/run/clamav/clamd.ctl")
+CLAMD_USE_TCP = env.bool("ALEXANDRIA_CLAMD_USE_TCP", default=True)
+CLAMD_TCP_SOCKET = env.str("ALEXANDRIA_CLAMD_TCP_SOCKET", default=3310)
+CLAMD_TCP_ADDR = env.str("ALEXANDRIA_CLAMD_TCP_ADDR", default="localhost")
+CLAMD_ENABLED = env.bool("ALEXANDRIA_CLAMD_ENABLED", default=False)

alexandria/settings/django.py

@@ -16,6 +16,7 @@
     "django.contrib.postgres",
     "localized_fields",
     "psqlextra",
+    "django_clamd",
     "django.contrib.contenttypes",
     "django.contrib.auth",
     "alexandria.core.apps.DefaultConfig",

pyproject.toml

@@ -19,6 +19,7 @@ packages = [{ include = "alexandria" }]
 [tool.poetry.dependencies]
 python = ">=3.8.1,<4.0"
 django = "~3.2"
+django-clamd = "^0.4.0"
 django-environ = ">=0.9.0,<0.12.0"
 django-filter = ">=22.1,<24.0"
 django-localized-fields = "^6.6"
@@ -27,6 +28,7 @@ djangorestframework-jsonapi = ">=5.0.0,<7.0.0"
 minio = "^7.1.14"
 mozilla-django-oidc = ">=2,<5"
 preview-generator = "^0.29"
+psutil = "^5.9.8"
 psycopg2-binary = "~2.9"
 requests = "^2.31.0"
 uwsgi = "^2.0.20"
@@ -64,7 +66,6 @@ python-semantic-release = "7.33.3"
 requests-mock = "1.11.0"
 syrupy = "4.6.1"
 werkzeug = "3.0.1"
-psutil = "^5.9.8"
 
 [tool.isort]
 skip = ["migrations"]